CVE-2022-39842

Katalog CVE

CVSS 6.1 · Medium EPSS 0,59%

Kerentanan Integer Overflow or Wraparound pada linux kernel, debian linux. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.

Rincian

Terbit di NVD

5 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-190: Integer Overflow or Wraparound

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19 release notes · advisory vendor
• https://github.com/torvalds/linux/commit/a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5257 advisory pihak ketiga
• https://lore.kernel.org/all/YylaC1wHHyLw22D3%40kadam/T/