Linux Kernel up to 5.17.2 mmmremap.c mremap off-by-one

Summaryinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.17.2. This vulnerability affects the function mremap of the file mmmremap.c. Executing a manipulation can lead to off-by-one. This vulnerability appears as CVE-2022-49077. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as problematic was found in Linux Kernel up to 5.17.2. This vulnerability affects the function mremap of the file mmmremap.c. The manipulation with an unknown input leads to a off-by-one vulnerability. The CWE definition for the vulnerability is CWE-193. A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: mmmremap.c: avoid pointless invalidate_range_start/end on mremap(old_size=0) If an mremap() syscall with old_size=0 ends up in move_page_tables(), it will call invalidate_range_start()/invalidate_range_end() unnecessarily, i.e. with an empty range. This causes a WARN in KVM's mmu_notifier. In the past, empty ranges have been diagnosed to be off-by-one bugs, hence the WARNing. Given the low (so far) number of unique reports, the benefits of detecting more buggy callers seem to outweigh the cost of having to fix cases such as this one, where userspace is doing something silly. In this particular case, an early return from move_page_tables() is enough to fix the issue.

The advisory is shared for download at git.kernel.org. This vulnerability was named CVE-2022-49077 since 02/26/2025. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/15/2025).

Upgrading to version 4.9.311, 4.14.276, 4.19.238, 5.4.189, 5.10.111, 5.15.34, 5.16.20 or 5.17.3 eliminates this vulnerability. Applying the patch a05540f3903bd8295e8c4cd90dd3d416239a115b/eeaf28e2a0128147d687237e59d5407ee1b14693/e2c328c2a8f9de8b761bd4025b66c63120c55761/c19d8de4e682ec4b0ea2b04a832cd8cc0be3bb31/7d659cb1763ff17d1c6ee082fa6feb4267c7a30b/a04cb99c5d4668fe3f5c0e5b6da1cecd34c3f219/2358aa84ef6dafcf544a557caaa6b91afb4a0bd2/04bc13dae4a27b8d030843c85ae452bb2f1d9c1f/01e67e04c28170c47700c2c226d732bbfedb1ad0 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.9.310
• 4.14.275
• 4.19.237
• 5.4.188
• 5.10.110
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.16.0
• 5.16.1
• 5.16.2
• 5.16.3
• 5.16.4
• 5.16.5
• 5.16.6
• 5.16.7
• 5.16.8
• 5.16.9
• 5.16.10
• 5.16.11
• 5.16.12
• 5.16.13
• 5.16.14
• 5.16.15
• 5.16.16
• 5.16.17
• 5.16.18
• 5.16.19
• 5.17.0
• 5.17.1
• 5.17.2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion