CVE-2022-49289

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49289", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-02-26T01:49:39.302Z", "datePublished": "2025-02-26T01:56:27.026Z", "dateUpdated": "2026-08-05T08:54:37.099Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:54:37.099Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuaccess: fix integer overflow on access_ok()\n\nThree architectures check the end of a user access against the\naddress limit without taking a possible overflow into account.\nPassing a negative length or another overflow in here returns\nsuccess when it should not.\n\nUse the most common correct implementation here, which optimizes\nfor a constant 'size' argument, and turns the common case into a\nsingle comparison."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in arch-specific access_ok() used by syscall copy_to/from_user paths; an attacker needs local ability to invoke syscalls with crafted user pointers and lengths on csky, hexagon, or microblaze.\nAC:L - Triggering only requires passing an address and size that cause addr+size to wrap; no race, probabilistic memory layout, or other condition outside the attacker\u2019s control is needed.\nPR:L - Any unprivileged local user can reach access_ok() through ordinary read/write/ioctl and related syscalls that validate user buffers; no root or special capabilities are required.\nUI:N - Exploitation is fully attacker-driven via syscalls and does not require any action by another user.\nS:U - Impact is confined to the local kernel\u2019s security authority (same-host privilege boundary); this is not a VM escape, IOMMU bypass, or other cross-authority break.\nC:H - A successful access_ok() bypass lets copy_from_user read kernel addresses as if they were userspace, enabling arbitrary kernel memory disclosure when that data is returned to the attacker.\nI:H - The same bypass lets copy_to_user/clear_user write into kernel virtual addresses, yielding a kernel memory corruption / write primitive usable for control-flow hijacking.\nA:H - Walking into invalid or sensitive kernel mappings via the unchecked copy path can oops/panic the kernel, and huge overflowing lengths can also produce fatal DoS behavior."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/csky/include/asm/uaccess.h", "arch/hexagon/include/asm/uaccess.h", "arch/microblaze/include/asm/uaccess.h"], "versions": [{"version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "lessThan": "e65d28d4e9bf90a35ba79c06661a572a38391dec", "status": "affected", "versionType": "git"}, {"version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "lessThan": "99801e2f457824955da4aadaa035913a6dede03a", "status": "affected", "versionType": "git"}, {"version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "lessThan": "a1ad747fc1a0e06d1bf26b996ee8a56b5c8d02d8", "status": "affected", "versionType": "git"}, {"version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "lessThan": "222ca305c9fd39e5ed8104da25c09b2b79a516a8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["arch/csky/include/asm/uaccess.h", "arch/hexagon/include/asm/uaccess.h", "arch/microblaze/include/asm/uaccess.h"], "versions": [{"version": "3.2", "status": "affected"}, {"version": "0", "lessThan": "3.2", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.32", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.18", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17.1", "lessThanOrEqual": "5.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.15.32"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.16.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.17.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.2", "versionEndExcluding": "5.18"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e65d28d4e9bf90a35ba79c06661a572a38391dec"}, {"url": "https://git.kernel.org/stable/c/99801e2f457824955da4aadaa035913a6dede03a"}, {"url": "https://git.kernel.org/stable/c/a1ad747fc1a0e06d1bf26b996ee8a56b5c8d02d8"}, {"url": "https://git.kernel.org/stable/c/222ca305c9fd39e5ed8104da25c09b2b79a516a8"}], "title": "uaccess: fix integer overflow on access_ok()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["arch/csky/include/asm/uaccess.h", "arch/hexagon/include/asm/uaccess.h", "arch/microblaze/include/asm/uaccess.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e65d28d4e9bf90a35ba79c06661a572a38391dec", "status": "affected", "version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "versionType": "git"}, {"lessThan": "99801e2f457824955da4aadaa035913a6dede03a", "status": "affected", "version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "versionType": "git"}, {"lessThan": "a1ad747fc1a0e06d1bf26b996ee8a56b5c8d02d8", "status": "affected", "version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "versionType": "git"}, {"lessThan": "222ca305c9fd39e5ed8104da25c09b2b79a516a8", "status": "affected", "version": "7567746e1c0d66ac0ef8a9d8816ca694462c7370", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["arch/csky/include/asm/uaccess.h", "arch/hexagon/include/asm/uaccess.h", "arch/microblaze/include/asm/uaccess.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.2"}, {"lessThan": "3.2", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.32", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.18", "versionType": "semver"}, {"lessThanOrEqual": "5.17.*", "status": "unaffected", "version": "5.17.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "00480024-DE11-483F-9FC2-2A54FC54891F", "versionEndExcluding": "5.15.32", "versionStartIncluding": "3.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C86410A0-E312-4F41-93E9-929EAFB31757", "versionEndExcluding": "5.16.18", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:5.17:*:*:*:*:*:*:*", "matchCriteriaId": "35799228-BFF6-4426-AD3B-F452EA83320F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nuaccess: fix integer overflow on access_ok()\n\nThree architectures check the end of a user access against the\naddress limit without taking a possible overflow into account.\nPassing a negative length or another overflow in here returns\nsuccess when it should not.\n\nUse the most common correct implementation here, which optimizes\nfor a constant 'size' argument, and turns the common case into a\nsingle comparison."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: uaccess: fix entire entiret overflow on access_ok() Tres arquitecturas comprueban el final de un acceso de usuario contra el l\u00edmite de direcciones sin tener en cuenta un posible desbordamiento. Pasar una longitud negativa u otro desbordamiento aqu\u00ed devuelve \u00e9xito cuando no deber\u00eda. Utilice la implementaci\u00f3n correcta m\u00e1s com\u00fan aqu\u00ed, que optimiza para un argumento de \"tama\u00f1o\" constante y convierte el caso com\u00fan en una \u00fanica comparaci\u00f3n."}], "id": "CVE-2022-49289", "lastModified": "2026-08-04T10:17:43.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-26T07:01:05.757", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/222ca305c9fd39e5ed8104da25c09b2b79a516a8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/99801e2f457824955da4aadaa035913a6dede03a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/a1ad747fc1a0e06d1bf26b996ee8a56b5c8d02d8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e65d28d4e9bf90a35ba79c06661a572a38391dec"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: uaccess: fix integer overflow on access_ok()", "id": "2348170", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2348170"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nuaccess: fix integer overflow on access_ok()\nThree architectures check the end of a user access against the\naddress limit without taking a possible overflow into account.\nPassing a negative length or another overflow in here returns\nsuccess when it should not.\nUse the most common correct implementation here, which optimizes\nfor a constant 'size' argument, and turns the common case into a\nsingle comparison."], "name": "CVE-2022-49289", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-02-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49289\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49289\nhttps://lore.kernel.org/linux-cve-announce/2025022633-CVE-2022-49289-3435@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-07-12T22:44:32.439934+00:00", "updated": "2025-07-12T22:44:32.439985+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}