CVE-2022-49769 Affecting kernel-tools-debuginfo package, versions <0:4.14.301-224.520.amzn2
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-AMZN2-KERNELTOOLSDEBUGINFO-10499885
- published25 Jun 2025
- disclosed1 May 2025
Introduced: 1 May 2025
CVE-2022-49769 (opens in a new tab)How to fix?
Upgrade Amazon-Linux:2 kernel-tools-debuginfo to version 0:4.14.301-224.520.amzn2 or higher.
This issue was patched in ALAS2-2022-1903.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-tools-debuginfo package and not the kernel-tools-debuginfo package as distributed by Amazon-Linux.
See How to fix? for Amazon-Linux:2 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
gfs2: Check sb_bsize_shift after reading superblock
Fuzzers like to scribble over sb_bsize_shift but in reality it's very unlikely that this field would be corrupted on its own. Nevertheless it should be checked to avoid the possibility of messy mount errors due to bad calculations. It's always a fixed value based on the block size so we can just check that it's the expected value.
Tested with:
mkfs.gfs2 -O -p lock_nolock /dev/vdb
for i in 0 -1 64 65 32 33; do
gfs2_edit -p sb field sb_bsize_shift $i /dev/vdb
mount /dev/vdb /mnt/test && umount /mnt/test
done
Before this patch we get a withdraw after
[ 76.413681] gfs2: fsid=loop0.0: fatal: invalid metadata block [ 76.413681] bh = 19 (type: exp=5, found=4) [ 76.413681] function = gfs2_meta_buffer, file = fs/gfs2/meta_io.c, line = 492
and with UBSAN configured we also get complaints like
[ 76.373395] UBSAN: shift-out-of-bounds in fs/gfs2/ops_fstype.c:295:19 [ 76.373815] shift exponent 4294967287 is too large for 64-bit type 'long unsigned int'
After the patch, these complaints don't appear, mount fails immediately and we get an explanation in dmesg.
References
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-49769
- https://git.kernel.org/stable/c/15c83fa0fd659dd9fbdc940a560b61236e876a80
- https://git.kernel.org/stable/c/16670534c7cff1acd918a6a5ec751b14e7436b76
- https://git.kernel.org/stable/c/1ad197097343568066a8ffaa27ee7d0ae6d9f476
- https://git.kernel.org/stable/c/28275a7c84d21c55ab3282d897f284d8d527173c
- https://git.kernel.org/stable/c/5fa30be7ba81191b0a0c7239a89befc0c94286d5
- https://git.kernel.org/stable/c/670f8ce56dd0632dc29a0322e188cc73ce3c6b92
- https://git.kernel.org/stable/c/8b6534c9ae9dba5489703a19d8ba6c8f2cfa33c2
- https://git.kernel.org/stable/c/d6b1e8ea6f3418c3b461ad5a35cdc93c996b2c87