CVE-2022-49952

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-49952", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-06-18T10:57:27.382Z", "datePublished": "2025-06-18T11:00:15.434Z", "dateUpdated": "2026-08-05T08:56:52.538Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:56:52.538Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix memory corruption on probe\n\nAdd the missing sanity check on the probed-session count to avoid\ncorrupting memory beyond the fixed-size slab-allocated session array\nwhen there are more than FASTRPC_MAX_SESSIONS sessions defined in the\ndevicetree."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is in the Qualcomm FastRPC platform compute-cb probe path during local DSP/rpmsg bring-up, not reachable via network packets or adjacent-link protocols.\nAC:L - On realistic Qualcomm device trees such as SC8280XP with 14 CDSP context banks (when FASTRPC_MAX_SESSIONS was 13) or oversized qcom,nsessions, probe reliably performs the out-of-bounds session array write with no attacker-uncontrollable race.\nPR:L - fastrpc_cb_probe runs from trusted DT during device bring-up without a capability gate; on primary Android/Qualcomm deployments the resulting kernel corruption is then reachable by low-privilege local processes using the fastrpc device nodes.\nUI:N - Exploitation requires no victim action; the overflow is triggered automatically when the compute-cb devices are probed.\nS:U - Impact is confined to kernel memory in the same host OS security authority (local privilege escalation), with no VM or IOMMU boundary crossed.\nC:H - The out-of-bounds write past the fixed session array corrupts adjacent channel_ctx fields (including idr and list pointers), which can be leveraged for arbitrary kernel memory disclosure.\nI:H - Out-of-bounds write into the spinlock, idr, and users list immediately following the session array enables classic kernel heap/list corruption primitives for arbitrary write and control-flow hijacking.\nA:H - Corrupting the channel spinlock, idr, or list_head reliably causes kernel oops, panic, or hangs when those structures are subsequently used."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/misc/fastrpc.c"], "versions": [{"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "lessThan": "ec186b9f4aa2e6444d5308a6cc268aada7007639", "status": "affected", "versionType": "git"}, {"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "lessThan": "c99bc901d5eb9fbdd7bd39f625e170ce97390336", "status": "affected", "versionType": "git"}, {"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "lessThan": "0e33b0f322fecd7a92d9dc186535cdf97940a856", "status": "affected", "versionType": "git"}, {"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "lessThan": "c0425c2facd9166fa083f90c9f3187ace0c7837a", "status": "affected", "versionType": "git"}, {"version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "lessThan": "9baa1415d9abdd1e08362ea2dcfadfacee8690b5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/misc/fastrpc.c"], "versions": [{"version": "5.1", "status": "affected"}, {"version": "0", "lessThan": "5.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.4.213", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.142", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.66", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.19.8", "lessThanOrEqual": "5.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.4.213"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.10.142"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.15.66"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "5.19.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.1", "versionEndExcluding": "6.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ec186b9f4aa2e6444d5308a6cc268aada7007639"}, {"url": "https://git.kernel.org/stable/c/c99bc901d5eb9fbdd7bd39f625e170ce97390336"}, {"url": "https://git.kernel.org/stable/c/0e33b0f322fecd7a92d9dc186535cdf97940a856"}, {"url": "https://git.kernel.org/stable/c/c0425c2facd9166fa083f90c9f3187ace0c7837a"}, {"url": "https://git.kernel.org/stable/c/9baa1415d9abdd1e08362ea2dcfadfacee8690b5"}], "title": "misc: fastrpc: fix memory corruption on probe", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/misc/fastrpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ec186b9f4aa2e6444d5308a6cc268aada7007639", "status": "affected", "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "versionType": "git"}, {"lessThan": "c99bc901d5eb9fbdd7bd39f625e170ce97390336", "status": "affected", "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "versionType": "git"}, {"lessThan": "0e33b0f322fecd7a92d9dc186535cdf97940a856", "status": "affected", "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "versionType": "git"}, {"lessThan": "c0425c2facd9166fa083f90c9f3187ace0c7837a", "status": "affected", "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "versionType": "git"}, {"lessThan": "9baa1415d9abdd1e08362ea2dcfadfacee8690b5", "status": "affected", "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/misc/fastrpc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.1"}, {"lessThan": "5.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.4.*", "status": "unaffected", "version": "5.4.213", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.142", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.66", "versionType": "semver"}, {"lessThanOrEqual": "5.19.*", "status": "unaffected", "version": "5.19.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4F0B32F6-E2D6-4C72-9760-7F18CA134535", "versionEndExcluding": "5.4.213", "versionStartIncluding": "5.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D44AD643-5591-432E-BD41-C2C737F54AC0", "versionEndExcluding": "5.10.142", "versionStartIncluding": "5.5", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "52AE7E2B-7BE3-4B8A-89CC-AB62434899A3", "versionEndExcluding": "5.15.66", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7FEC7656-4CE2-424C-8830-EDB160E701C8", "versionEndExcluding": "5.19.8", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "5F0AD220-F6A9-4012-8636-155F1B841FAD", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "A46498B3-78E1-4623-AAE1-94D29A42BE4E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix memory corruption on probe\n\nAdd the missing sanity check on the probed-session count to avoid\ncorrupting memory beyond the fixed-size slab-allocated session array\nwhen there are more than FASTRPC_MAX_SESSIONS sessions defined in the\ndevicetree."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: misc: fastrpc: corregir corrupci\u00f3n de memoria en la sonda Agregue la verificaci\u00f3n de cordura faltante en el recuento de sesiones sondeadas para evitar corromper la memoria m\u00e1s all\u00e1 de la matriz de sesiones asignadas por bloques de tama\u00f1o fijo cuando hay m\u00e1s de FASTRPC_MAX_SESSIONS sesiones definidas en el \u00e1rbol de dispositivos."}], "id": "CVE-2022-49952", "lastModified": "2026-08-04T10:18:00.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-06-18T11:15:22.277", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0e33b0f322fecd7a92d9dc186535cdf97940a856"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/9baa1415d9abdd1e08362ea2dcfadfacee8690b5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c0425c2facd9166fa083f90c9f3187ace0c7837a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c99bc901d5eb9fbdd7bd39f625e170ce97390336"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ec186b9f4aa2e6444d5308a6cc268aada7007639"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: misc: fastrpc: fix memory corruption on probe", "id": "2373694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2373694"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmisc: fastrpc: fix memory corruption on probe\nAdd the missing sanity check on the probed-session count to avoid\ncorrupting memory beyond the fixed-size slab-allocated session array\nwhen there are more than FASTRPC_MAX_SESSIONS sessions defined in the\ndevicetree."], "name": "CVE-2022-49952", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-06-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-49952\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-49952\nhttps://lore.kernel.org/linux-cve-announce/2025061810-CVE-2022-49952-0994@gregkh/T"], "threat_severity": "Moderate"}

{"created": "2025-06-23T08:45:29.444465+00:00", "updated": "2025-06-23T08:45:29.444519+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}