Re: CVE-2022-49444: module: fix [e_shstrndx].sh_size=0 OOB access

[Greg KH]

On Mon, Mar 17, 2025 at 08:14:16AM +0000, Brendan Jackman wrote:
> > It is trivial to craft a module to trigger OOB access in this line:
> 
> Requires loading a crafted module?  I don't think there's any coherent threat
> model where this is a vuln. Probably a CVE to revoke?

Look at the commit this is marked as fixing.  It was a "feature"
introduced to properly harden elf sections in modules.  So if you are
relying on that new thing, then yes, this is a vulnerability.  If your
system does not, then your system is not vulnerable to this issue.

thanks,

greg k-h