Integer Underflow Vulnerability in Linux Kernel (CVE-2022-49208)
Summary
CVE-2022-49208: In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent some integer underflows My static checker complains that: drivers/infiniband/hw/irdma/ctrl.c:3605 irdma_sc_ceq_init() warn: can subt... Affects linux versions < 5.17.3-1. Fixed in 5.17.3-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware and software interactions. It supports a wide range of functionalities, including process management, memory management, and device control. The kernel is critical for system stability and security, making it vital to address any vulnerabilities that may arise.
Vulnerability Detail
CVE-2022-49208 is an integer underflow vulnerability found in the RDMA/irdma driver of the Linux kernel. This issue arises in the function irdma_sc_ceq_init() where a subtraction operation could potentially lead to an underflow if the value of 'info->dev->hmc_fpm_misc.max_ceqs' is zero. This vulnerability could allow attackers to exploit the system, leading to unexpected behavior or crashes, thereby compromising system integrity and security.
How To Fix
Minimum fixed version
5.17.3-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. However, ensuring that the firmware is properly configured and monitored can help mitigate potential risks until the package is updated.
Conclusion
CVE-2022-49208 presents a significant risk to systems using the Linux kernel, particularly those utilizing the RDMA/irdma driver. It is crucial to update to the patched version to ensure system security and stability. Monitoring tools like Vulert can assist in identifying vulnerabilities in your applications.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49208 is a vulnerability in the Linux kernel related to integer underflows in the RDMA/irdma driver.
This vulnerability can lead to unexpected behavior or crashes in systems using the affected driver, potentially compromising system security.
You should update your Linux package to version 5.17.3-1 or later to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground without any signup.
Vulert is a tool that uses a manifest file like package-lock.json to monitor and alert in real-time for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
