← Back to CVE Explorer

CVE-2022-49077

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue.

Severity
MEDIUM
CVSS score
5.5 (v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2025-02-26 07:00:45.043000
Last modified
2026-11-05 20:16:57.693000
View original CVE JSON 
{
  "id": "CVE-2022-49077",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2025-02-26T07:00:45.043",
  "lastModified": "2026-11-05T20:16:57.693",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0)\n\nIf an mremap() syscall with old_size=0 ends up in move_page_tables(), it\nwill call invalidate_range_start()/invalidate_range_end() unnecessarily,\ni.e.  with an empty range.\n\nThis causes a WARN in KVM's mmu_notifier.  In the past, empty ranges\nhave been diagnosed to be off-by-one bugs, hence the WARNing.  Given the\nlow (so far) number of unique reports, the benefits of detecting more\nbuggy callers seem to outweigh the cost of having to fix cases such as\nthis one, where userspace is doing something silly.  In this particular\ncase, an early return from move_page_tables() is enough to fix the\nissue."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mmmremap.c: evitar invalidate_range_start/end inútil en mremap(old_size=0) Si una llamada al sistema mremap() con old_size=0 termina en move_page_tables(), llamará a invalidate_range_start()/invalidate_range_end() innecesariamente, es decir, con un rango vacío. Esto provoca una ADVERTENCIA en mmu_notifier de KVM. En el pasado, se ha diagnosticado que los rangos vacíos eran errores con un desfase de uno, de ahí la ADVERTENCIA. Dado el bajo número (hasta ahora) de informes únicos, los beneficios de detectar más llamadores con errores parecen superar el costo de tener que arreglar casos como este, donde el espacio de usuario está haciendo algo tonto. En este caso particular, un retorno temprano de move_page_tables() es suficiente para solucionar el problema."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "mm/mremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "a05540f3903bd8295e8c4cd90dd3d416239a115b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "eeaf28e2a0128147d687237e59d5407ee1b14693",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "e2c328c2a8f9de8b761bd4025b66c63120c55761",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "7d659cb1763ff17d1c6ee082fa6feb4267c7a30b",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "2358aa84ef6dafcf544a557caaa6b91afb4a0bd2",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "04bc13dae4a27b8d030843c85ae452bb2f1d9c1f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7b6efc2bc4f19952b25ebf9b236e5ac43cd386c2",
              "lessThan": "01e67e04c28170c47700c2c226d732bbfedb1ad0",
              "versionType": "git",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "mm/mremap.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "3.2",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "3.2",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.9.311",
              "lessThanOrEqual": "4.9.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.14.276",
              "lessThanOrEqual": "4.14.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "4.19.238",
              "lessThanOrEqual": "4.19.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.4.189",
              "lessThanOrEqual": "5.4.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.111",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.34",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.16.20",
              "lessThanOrEqual": "5.16.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.17.3",
              "lessThanOrEqual": "5.17.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.18",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-11-05T19:42:49.710972Z",
          "id": "CVE-2022-49077",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-193"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "4.9.311",
              "matchCriteriaId": "C86EFD13-93D4-4385-83E8-C665BE8F570F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.10",
              "versionEndExcluding": "4.14.276",
              "matchCriteriaId": "6D9B028C-6313-47F9-94B7-5F8122345E49"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.15",
              "versionEndExcluding": "4.19.238",
              "matchCriteriaId": "FA28527A-11D3-41D2-9C4C-ECAC0D6A4A2D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "4.20",
              "versionEndExcluding": "5.4.189",
              "matchCriteriaId": "8CB6E8F5-C2B1-46F3-A807-0F6104AC340F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.5",
              "versionEndExcluding": "5.10.111",
              "matchCriteriaId": "96258501-7BCE-4C55-8A38-8AC9D327626D"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.11",
              "versionEndExcluding": "5.15.34",
              "matchCriteriaId": "D25878D3-7761-4E9F-8919-E92CD53896E0"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.16",
              "versionEndExcluding": "5.16.20",
              "matchCriteriaId": "ABBBA66E-0244-4621-966B-9790AF1EEB00"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "5.17",
              "versionEndExcluding": "5.17.3",
              "matchCriteriaId": "AE420AC7-1E59-4398-B84F-71F4B4337762"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "6AD94161-84BB-42E6-9882-4FC0C42E9FC1"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/01e67e04c28170c47700c2c226d732bbfedb1ad0",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/04bc13dae4a27b8d030843c85ae452bb2f1d9c1f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/2358aa84ef6dafcf544a557caaa6b91afb4a0bd2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/7d659cb1763ff17d1c6ee082fa6feb4267c7a30b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/a05540f3903bd8295e8c4cd90dd3d416239a115b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/e2c328c2a8f9de8b761bd4025b66c63120c55761",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://git.kernel.org/stable/c/eeaf28e2a0128147d687237e59d5407ee1b14693",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "tags": [
        "Patch"
      ]
    }
  ]
}