CVE-2022-49035

Jan. 9, 2025, 8:22 p.m.

5.5
Medium

Description

In the Linux kernel, the following vulnerability has been resolved: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case.

Product(s) Impacted

Vendor Product Versions
Linux
  • Linux Kernel
  • *, 6.1

Weaknesses

CWE-770
Allocation of Resources Without Limits or Throttling
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.

*CPE(s)

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel / / / / / / / /
o linux linux_kernel 6.1 rc1 / / / / / /

References

https://git.kernel.org/stable/c/1609231f86760c1f6a429de7913dd795b9faa08c
https://git.kernel.org/stable/c/2654e785bd4aa2439cdffbe7dc1ea30a0eddbfe4
https://git.kernel.org/stable/c/4a449430ecfb199b99ba58af63c467eb53500b39
https://git.kernel.org/stable/c/7ccb40f26cbefa1c6dfd3418bea54c9518cdbd8a
https://git.kernel.org/stable/c/93f65ce036863893c164ca410938e0968964b26c
https://git.kernel.org/stable/c/a2728bf9b6c65e46468c763e3dab7e04839d4e11
https://git.kernel.org/stable/c/cbfa26936f318b16ccf9ca31b8e8b30c0dc087bd
https://git.kernel.org/stable/c/fc0f76dd5f116fa9291327024dda392f8b4e849c

Tags

416baaa9-dc9f-4396-8d5f-8c081fb06d67
CWE-770
2025-01-02
CVE-2022-49035

CVSS Score

5.5 / 10

CVSS Data

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Date

  • Published: Jan. 2, 2025, 3:15 p.m.
  • Last Modified: Jan. 9, 2025, 8:22 p.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

416baaa9-dc9f-4396-8d5f-8c081fb06d67

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.