PT-2025-8217 · Linux+2 · Linux Kernel+2

David Laight · Publicado 2022-01-01 · Atualizado 2026-03-14 · CVE-2022-49289

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to an integer overflow in the access ok() function, which is used to check user access. Specifically, three architectures do not account for a possible overflow when checking the end of a user access against the address limit. This can lead to incorrect results when passing a negative length or another overflow. The problem arises from the lack of proper overflow handling, which can cause the function to return success when it should not.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

BDU:2026-03930

CVE-2022-49289

Produtos afetados

Astra Linux

Debian

Linux Kernel

Referências · 21

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49289.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-49289 · Aviso do Fabricante
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2022-49289 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-49289 · Nota de Segurança
• https://git.kernel.org/stable/c/a1ad747fc1a0e06d1bf26b996ee8a56b5c8d02d8 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49289 · Aviso do Fabricante
• https://git.kernel.org/linus/222ca305c9fd39e5ed8104da25c09b2b79a516a8 · Nota
• https://cve.org/CVERecord?id=CVE-2022-49289 · Nota de Segurança
• https://lore.kernel.org/linux-cve-announce/2025022633-CVE-2022-49289-3435@gregkh · Nota
• https://git.kernel.org/stable/c/99801e2f457824955da4aadaa035913a6dede03a · Correção
• https://security-tracker.debian.org/tracker/CVE-2022-49289 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1894573463299657957 · Publicação no Twitter
• https://t.me/cveNotify/136060 · Publicação no Telegram
• https://git.kernel.org/stable/c/e65d28d4e9bf90a35ba79c06661a572a38391dec · Correção
• https://git.kernel.org/stable/c/222ca305c9fd39e5ed8104da25c09b2b79a516a8 · Correção