CVE-2022-49743

In the Linux kernel, the following vulnerability has been resolved:

ovl: Use "buf" flexible array for memcpy() destination

The "buf" flexible array needs to be the memcpy() destination to avoid false positive run-time warning from the recent FORTIFY_SOURCE hardening:

memcpy: detected field-spanning write (size 93) of single field "&fh->fb" at fs/overlayfs/export.c:799 (size 21)

This vulnerability is rated as Moderate because exploitation is limited to a local denial of service without compromising system confidentiality or integrity. An authenticated local user with the ability to trigger OverlayFS file handle operations can cause the kernel FORTIFY_SOURCE runtime checks to detect a field-spanning write, potentially leading to a system crash or warning. Because the flaw requires local execution and does not permit arbitrary code execution or privilege escalation, it does not warrant an Important severity rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.