Subtraction Overflow Vulnerability in Linux Kernel (CVE-2022-49635)
Summary
CVE-2022-49635: In the Linux kernel, the following vulnerability has been resolved: drm/i915/selftests: fix subtraction overflow bug On some machines hole_end can be small enough to cause subtraction overflow. Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to software applications. It is widely used in various environments, from servers to embedded systems. The kernel's stability and security are paramount, as vulnerabilities can lead to system crashes, data loss, or unauthorized access. This specific vulnerability affects the Direct Rendering Manager (DRM) subsystem, particularly the i915 graphics driver, which is crucial for managing Intel graphics hardware.
Vulnerability Detail
CVE-2022-49635 is a subtraction overflow vulnerability found in the Linux kernel's DRM/i915 self-tests. On certain machines, the variable 'hole_end' can be small enough to cause a subtraction overflow, leading to potential memory corruption or unexpected behavior. Additionally, in mock tests, the expression 'addr + 2 * min_alignment' can also overflow. This vulnerability could compromise system integrity and stability, making it critical to address.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it becomes available to ensure system security.
Conclusion
CVE-2022-49635 is a critical vulnerability in the Linux kernel that can lead to serious system issues due to subtraction overflow in the DRM/i915 self-tests. It is essential to update to the patched version of the Linux package to protect your system from potential exploitation. Regular monitoring and updates are vital for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49635 is a vulnerability in the Linux kernel related to subtraction overflow in the DRM/i915 self-tests, which can lead to memory corruption.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any installation.
The vulnerability could lead to system instability, crashes, or unauthorized access due to memory corruption.
Yes, a patch is available in version 5.18.14-1 and later of the Linux package. It is recommended to update your system to this version.
While there are no specific workarounds, it is crucial to prioritize applying the patch as soon as possible to mitigate risks.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
