CVE-2022-48847

What it actually does

Incorrect bitmap size check in watch_queue_set_filter allows out-of-bounds writes via __set_bit on type_filter and overflow of the filters array when a filter type exceeds the supported range, resulting in slab-out-of-bounds memory corruption.

Why it matters to the business

Local users on affected Linux kernels can trigger kernel crashes or memory corruption that may lead to privilege escalation or denial of service, requiring urgent patching of production systems and potentially disrupting workloads until fixed kernels are deployed.

How an attack unfolds

An attacker with local access crafts an ioctl call to watch_queue_set_filter supplying a filter type value large enough to bypass the flawed limit check; this triggers an out-of-bounds write into kernel slab memory, which can be leveraged for further corruption or code execution.

How to fix it

Upgrade to a kernel containing commit 648895da69ced90ca770fd941c3d9479a9d72c16 or later; rebuild and reboot with the patched kernel. Where immediate upgrade is impossible, restrict unprivileged access to watch_queue ioctls via seccomp or capabilities.

How to confirm the fix worked

Confirm the running kernel contains commit 648895da69ced90ca770fd941c3d9479a9d72c16 by checking /proc/version or kernel build logs; attempt to reproduce the original KASAN report with a test program that supplies an out-of-range filter type and verify no slab-out-of-bounds occurs.

Typical attack path

1. Obtain local shell or process execution on target system
2. Open a watch_queue file descriptor
3. Invoke ioctl with a malicious filter structure containing an oversized type value
4. Trigger out-of-bounds write into kmalloc-32 slab object
5. Use resulting memory corruption to escalate privileges or cause denial of service

How to detect it

Search kernel logs for KASAN reports mentioning watch_queue_set_filter and slab-out-of-bounds writes; inspect audit logs for unusual ioctl calls on watch_queue file descriptors by non-root processes.

• BUG: KASAN: slab-out-of-bounds in watch_queue_set_filter
• watch_queue_set_filter+0x659/0x740
• Write of size 4 at addr .* by task .*watch_queue

What your security team should do

• Prioritize patching all Linux systems to the fixed commit within the next maintenance window
• Audit systems for any custom watch_queue usage and restrict ioctl access where possible
• Monitor for kernel oops or KASAN reports referencing watch_queue_set_filter
• Review and update kernel update policies to reduce days-since-published exposure on future issues