Boundary Condition Vulnerability in Linux Kernel Power Supply Package
Summary
CVE-2022-49612: In the Linux kernel, the following vulnerability has been resolved: power: supply: core: Fix boundary conditions in interpolation The functions power_supply_temp2resist_simple and power_supply_ocv2cap_simple handle bound... Affects linux versions < 5.18.14-1. Fixed in 5.18.14-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. The power supply subsystem within the kernel manages power sources and battery information, ensuring efficient energy use. This subsystem is crucial for devices relying on battery power, such as laptops and mobile devices. The vulnerability in question affects the interpolation functions within this subsystem, potentially leading to incorrect readings and system instability.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the power supply subsystem, specifically in the functions power_supply_temp2resist_simple and power_supply_ocv2cap_simple. These functions incorrectly handle boundary conditions, leading to out-of-bounds reads and incorrect resistance calculations. The issues stem from a change introduced in commit a4585ba2050f460f749bbaf2b67bd56c41e30283. The first issue occurs when ocv2cap sets high=-1 if ocv exceeds the first entry in the table, resulting in an out-of-bounds read. The second issue arises in temp2resist, where the logic fails to interpolate correctly, returning inaccurate resistance values.
How To Fix
Minimum fixed version
5.18.14-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The best course of action is to apply the patch as soon as it is available.
Conclusion
The CVE-2022-49612 vulnerability in the Linux kernel's power supply subsystem poses significant risks due to incorrect handling of boundary conditions in interpolation functions. Users are strongly encouraged to update their systems to the patched version to ensure stability and security.
See every vulnerability recorded for linux →
FAQ
CVE-2022-49612 is a vulnerability in the Linux kernel's power supply subsystem that affects how boundary conditions are handled in certain interpolation functions.
The vulnerability can lead to out-of-bounds reads and incorrect resistance calculations, which may cause system instability or incorrect power management.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
Yes, a patch has been released in version 5.18.14-1 of the Linux kernel. Users are advised to update to this version or later.
While there are no specific workarounds, it is crucial to prioritize updating your kernel to mitigate the risks associated with this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
