Overflow Vulnerability in Linux Kernel's CPPC Implementation
Summary
CVE-2022-49750: In the Linux kernel, the following vulnerability has been resolved: cpufreq: CPPC: Add u64 casts to avoid overflowing The fields of the _CPC object are unsigned 32-bits values. Affects linux versions < 6.1.11-1. Fixed in 6.1.11-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interaction. It is known for its stability, performance, and flexibility, making it a popular choice for servers, desktops, and embedded systems. The kernel supports various hardware architectures and is continuously updated to enhance security and functionality. This vulnerability specifically affects the cpufreq subsystem, which manages CPU frequency scaling to optimize power consumption and performance.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the cpufreq subsystem related to the CPPC (Collaborative Processor Performance Control) implementation. The issue arises from the use of unsigned 32-bit values in the _CPC object, which can lead to overflow when these values are manipulated. This overflow can potentially cause incorrect CPU frequency scaling, leading to performance degradation or system instability. The vulnerability has been assigned the identifier CVE-2022-49750 and affects multiple Debian versions of the Linux package.
How To Fix
Minimum fixed version
6.1.11-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it becomes available to mitigate any risks associated with this issue.
Conclusion
The CVE-2022-49750 vulnerability in the Linux kernel's cpufreq subsystem poses a risk of overflow due to the handling of unsigned 32-bit values. It is crucial for users of affected Debian versions to update their systems to the patched version to ensure stability and performance. Monitoring tools like Vulert can assist in identifying vulnerabilities in your software without requiring code access.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49750 is a vulnerability in the Linux kernel's cpufreq subsystem that can lead to overflow issues when handling CPU performance control values.
The vulnerability affects Debian versions 11, 12, and 13 of the Linux package.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability could lead to incorrect CPU frequency scaling, resulting in performance issues or system instability.
Yes, a patch is available in version 6.1.11-1 for Debian 12 and 13. It is recommended to update to this version to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
