305 lines
15 KiB
JSON
305 lines
15 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-49451",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2025-02-26T02:08:31.572Z",
|
||
"datePublished": "2025-02-26T02:13:01.077Z",
|
||
"dateUpdated": "2026-08-05T08:55:12.845Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:55:12.845Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix list protocols enumeration in the base protocol\n\nWhile enumerating protocols implemented by the SCMI platform using\nBASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is\ncurrently validated in an improper way since the check employs a sum\nbetween unsigned integers that could overflow and cause the check itself\nto be silently bypassed if the returned value 'loop_num_ret' is big\nenough.\n\nFix the validation avoiding the addition."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 8.4,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The overflow is reached only while processing local SCMI platform replies on mailbox/SMC/OP-TEE/virtio transports during base-protocol init (scmi_probe → scmi_protocol_acquire(BASE) → scmi_base_implementation_list_get); there is no network or adjacent-protocol path into this enumeration.\nAC:L - A malicious SCMI peer fully controls loop_num_ret and can deterministically return a small first batch then 0xFFFFFFFF so tot_num_ret + loop_num_ret wraps and bypasses the bounds check, with no race or attacker-uncontrollable condition.\nPR:N - Under the virtio-scmi and compromised-SCP threat models the attacker needs no guest/OS account or capability—crafted BASE_DISCOVER_LIST_PROTOCOLS responses are consumed automatically at probe with no authentication on the Linux side.\nUI:N - Base-protocol enumeration runs automatically during SCMI device probe at boot/hotplug; no victim mount, open, or other interactive step is required.\nS:U - The resulting heap corruption stays inside the host/guest kernel’s own security authority; this is not a guest-to-host escape, IOMMU bypass, or Normal/Secure-world boundary cross.\nC:H - Bypassing the check drives an unbounded for-loop that both over-reads past the rx message buffer (list + loop) and corrupts adjacent heap via the 16-byte protocols_imp write, yielding disclosure primitives consistent with OOB/memory-corruption guidance.\nI:H - The same integer-overflow bypass produces a heap out-of-bounds write past the MAX_PROTOCOLS_IMP-sized protocols_imp allocation, which is an arbitrary-write/control-flow hijack primitive under kernel CVSS guidance.\nA:H - The huge post-wrap loop_num_ret inevitably faults on OOB read/write or corrupts allocator state into an oops/panic, so availability impact is High even without a full exploit."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/firmware/arm_scmi/base.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
|
||
"lessThan": "444a2d27fe9867d0da4b28fc45b793f32e099ab8",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
|
||
"lessThan": "b0e4bafac8963c2d85ee18d3d01f393735acceec",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
|
||
"lessThan": "1052f22e127d0c34c3387bb389424ba1c61491ff",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
|
||
"lessThan": "98342148a8cd242855d7e257f298c966c96dba9f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
|
||
"lessThan": "6e7978695f4a6cbd83616b5a702b77fa2087b247",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
|
||
"lessThan": "2ccfcd7a09c826516edcfe464b05071961aada3f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
|
||
"lessThan": "8009120e0354a67068e920eb10dce532391361d0",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/firmware/arm_scmi/base.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "4.17",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "4.17",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "4.19.247",
|
||
"lessThanOrEqual": "4.19.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.4.198",
|
||
"lessThanOrEqual": "5.4.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.10.121",
|
||
"lessThanOrEqual": "5.10.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.46",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.17.14",
|
||
"lessThanOrEqual": "5.17.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.18.3",
|
||
"lessThanOrEqual": "5.18.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.19",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.17",
|
||
"versionEndExcluding": "4.19.247"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.17",
|
||
"versionEndExcluding": "5.4.198"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.17",
|
||
"versionEndExcluding": "5.10.121"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.17",
|
||
"versionEndExcluding": "5.15.46"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.17",
|
||
"versionEndExcluding": "5.17.14"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.17",
|
||
"versionEndExcluding": "5.18.3"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "4.17",
|
||
"versionEndExcluding": "5.19"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceec"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9f"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0"
|
||
}
|
||
],
|
||
"title": "firmware: arm_scmi: Fix list protocols enumeration in the base protocol",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"scope": "UNCHANGED",
|
||
"version": "3.1",
|
||
"baseScore": 5.5,
|
||
"attackVector": "LOCAL",
|
||
"baseSeverity": "MEDIUM",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
|
||
"integrityImpact": "NONE",
|
||
"userInteraction": "NONE",
|
||
"attackComplexity": "LOW",
|
||
"availabilityImpact": "HIGH",
|
||
"privilegesRequired": "LOW",
|
||
"confidentialityImpact": "NONE"
|
||
}
|
||
},
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-49451",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2025-10-01T19:40:29.513301Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"type": "CWE",
|
||
"cweId": "CWE-190",
|
||
"description": "CWE-190 Integer Overflow or Wraparound"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2025-10-01T19:46:48.095Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |