CVE-2022-49743

CVE-2022-49743

High · published March 27, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
38.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

ovl: Use "buf" flexible array for memcpy() destination

The "buf" flexible array needs to be the memcpy() destination to avoid

false positive run-time warning from the recent FORTIFY_SOURCE

hardening:

memcpy: detected field-spanning write (size 93) of single field "&fh->fb"

at fs/overlayfs/export.c:799 (size 21)

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00452 · 38.3th percentile
Published
2025-03-27T21:15Z
Affected products (2)
ProductVersionsFixed in
linux/linux_kernel< 5.15.935.15.93
linux/linux_kernel≥ 5.16, < 6.1.116.1.11
References (4)
https://git.kernel.org/stable/c/012cdef22000f3104e4fa8224ad29fde509b8caf · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/07a96977b2f462337a9121302de64277b8747ab1 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a77141a06367825d639ac51b04703d551163e36c · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cf8aa9bf97cadf85745506c6a3e244b22c268d63 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
EPSS history
Timeline
  • 27 MAR 16:42Z
    ovl: Use "buf" flexible array for memcpy() destination
    cvelistv5