PT-2022-7366 · Linux+3 · Linux Kernel+3

Published 2022-09-22 · Updated 2024-08-19 · CVE-2022-48657

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to a possible overflow in the amu fie setup() function. The cpufreq get hw max freq() function returns the maximum frequency in kHz as an unsigned int, while the freq inv set max ratio() function gets passed this frequency in Hz as a u64. Multiplying the maximum frequency by 1000 can potentially result in an overflow. The Linux Verification Center found this issue using the SVACE static analysis tool.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2024-04235

CVE-2022-48657

OPENSUSE-SU-2024_1641-1

OPENSUSE-SU-2024_1644-1

OPENSUSE-SU-2024_1659-1

OPENSUSE-SU-2024_1663-1

SUSE-SU-2024:1641-1

SUSE-SU-2024:1644-1

SUSE-SU-2024:1647-1

SUSE-SU-2024:1659-1

SUSE-SU-2024:1663-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 573

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48657.json · Exploit
• 🔥 https://github.com/MaherAzzouzi/CVE-2024-26817-amdkfd · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-48657 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-48657 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48657 · Vendor Advisory
• https://git.kernel.org/stable/c/d4955c0ad77dbc684fc716387070ac24801b8bca · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:1641-1 · Vendor Advisory
• https://git.kernel.org/stable/c/3c3edb82d67b2be9231174ac2af4af60d4af7549 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:1647-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1659-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-48657 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-48657 · Security Note
• https://git.kernel.org/stable/c/bb6d99e27cbe6b30e4e3bbd32927fd3b0bdec6eb · Patch
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://git.kernel.org/stable/c/904f881b57360cf85de962d84d8614d94431f60e · Patch