Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-49264— exec: Force single empty string when argv is empty

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于execve中argv为空时未强制单个空字符串。

CVSS 7.8 · High EPSS 0.30% · P23

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 41f6ea5b9aaa28b740d47ffe995a5013211fdbb0 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 98e0c7c702894987732776736c99b85ade6fba45 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< b50fb8dbc8b81aaa126387de428f4c42a7c72a73 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 1fe82bfd9e4ce93399d815ca458b58505191c3e8 affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 27a6f495b63a1804cc71be45911065db7757a98c affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< 1290eb4412aa0f0e9f3434b406dc8e255da85f9e affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< a8054d3fa5deb84b215d6be1b910a978f3cb840d affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2< cfbfff8ce5e3d674947581f1eb9af0a1b1807950 affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2022-49264

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
exec: Force single empty string when argv is empty
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: exec: Force single empty string when argv is empty Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name of a program, thus prohibiting a scenario where argc < 1. POSIX 2017 also recommends this behaviour, but it is not an explicit requirement[2]: The argument arg0 should point to a filename string that is associated with the process being started by one of the exec functions. ... Interestingly, Michael Kerrisk opened an issue about this in 2008[3], but there was no consensus to support fixing this issue then. Hopefully now that CVE-2021-4034 shows practical exploitative use[4] of this bug in a shellcode, we can reconsider. This issue is being tracked in the KSPP issue tracker[5]." While the initial code searches[6][7] turned up what appeared to be mostly corner case tests, trying to that just reject argv == NULL (or an immediately terminated pointer list) quickly started tripping[8] existing userspace programs. The next best approach is forcing a single empty string into argv and adjusting argc to match. The number of programs depending on argc == 0 seems a smaller set than those calling execve with a NULL argv. Account for the additional stack space in bprm_stack_limits(). Inject an empty string when argc == 0 (and set argc = 1). Warn about the case so userspace has some notice about the change: process './argc0' launched './argc0' with NULL argv: empty string added Additionally WARN() and reject NULL argv usage for kernel threads. [1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereferenced.org/ [2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html [3] https://bugzilla.kernel.org/show_bug.cgi?id=8408 [4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt [5] https://github.com/KSPP/linux/issues/176 [6] https://codesearch.debian.net/search?q=execve%5C+*%5C%28%5B%5E%2C%5D%2B%2C+*NULL&literal=0 [7] https://codesearch.debian.net/search?q=execlp%3F%5Cs*%5C%28%5B%5E%2C%5D%2B%2C%5Cs*NULL&literal=0 [8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于execve中argv为空时未强制单个空字符串。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 ~ 41f6ea5b9aaa28b740d47ffe995a5013211fdbb0 -
Linux Linux 2.6.12 -

II. Public POCs for CVE-2022-49264

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-49264

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-49264 (9)

Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total

CVE-2022-49201 9.8 CRITICAL ibmvnic: fix race between xmit and reset
CVE-2022-49280 9.8 CRITICAL NFSD: prevent underflow in nfssvc_decode_writeargs()
CVE-2022-49407 9.8 CRITICAL dlm: fix plock invalid read
CVE-2022-49362 9.8 CRITICAL NFSD: Fix potential use-after-free in nfsd_file_put()
CVE-2022-49093 9.8 CRITICAL skbuff: fix coalescing for page_pool fragment recycling
CVE-2022-49561 9.8 CRITICAL netfilter: conntrack: re-fetch conntrack after insertion
CVE-2022-49356 9.8 CRITICAL SUNRPC: Trap RDMA segment overflows
CVE-2022-49094 9.8 CRITICAL net/tls: fix slab-out-of-bounds bug in decrypt_internal
CVE-2022-49418 9.8 CRITICAL NFSv4: Fix free of uninitialized nfs4_label on referral lookup.
CVE-2022-49260 9.8 CRITICAL crypto: hisilicon/sec - fix the aead software fallback for engine
CVE-2022-49194 9.8 CRITICAL net: bcmgenet: Use stronger register read/writes to assure ordering
CVE-2022-49149 9.8 CRITICAL rxrpc: Fix call timer start racing with call destruction
CVE-2022-49058 9.1 CRITICAL cifs: potential buffer overflow in handling symlinks
CVE-2022-49519 8.8 HIGH ath10k: skip ath10k_halt during suspend for driver state RESTARTING
CVE-2022-49238 8.8 HIGH ath11k: free peer for station when disconnect from AP for QCA6390/WCN6855
CVE-2022-49471 8.8 HIGH rtw89: cfo: check mac_id to avoid out-of-bounds
CVE-2022-49159 8.8 HIGH scsi: qla2xxx: Implement ref count for SRB
CVE-2022-49479 8.8 HIGH mt76: fix tx status related use-after-free race on station removal
CVE-2022-49500 8.8 HIGH wl1251: dynamically allocate memory used for DMA
CVE-2022-49138 8.8 HIGH Bluetooth: hci_event: Ignore multiple conn complete events

Showing top 20 of 706 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-49264

No comments yet

Leave a comment