CVE-2022-49147

block: Fix the maximum minor value is blk_alloc_ext_minor()

published February 26, 2025

CVSS
—
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

block: Fix the maximum minor value is blk_alloc_ext_minor()

ida_alloc_range(..., min, max, ...) returns values from min to max,

inclusive.

So, NR_EXT_DEVT is a valid idx returned by blk_alloc_ext_minor().

This is an issue because in device_add_disk(), this value is used in:

ddev->devt = MKDEV(disk->major, disk->first_minor);

and NR_EXT_DEVT is '(1 << MINORBITS)'.

So, should 'disk->first_minor' be NR_EXT_DEVT, it would overflow.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Published
2025-02-26T01:55Z
EPSS history
Timeline
  • 26 FEB 01:55Z
    block: Fix the maximum minor value is blk_alloc_ext_minor()
    cvelistv5