PT-2024-11852 · Linux+4 · Linux Kernel+4

Published 2022-11-23 · Updated 2025-09-29 · CVE-2022-48987

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue concerns the media component of the Linux kernel, specifically the v4l2-dv-timings.c file. It involves incorrect input validation in the v4l2 valid dv timings() function, which can lead to integer overflows when userspace passes unusual values. The problem arises when userspace only knows the total blanking and assigns it to one field, causing the sanity checks to fail. To resolve this, a maximum for the total horizontal and vertical blanking has been set, allowing for more flexibility in how userspace fills in these fields. This change is sufficient to avoid integer overflows. The exploitation of this issue may allow an attacker to cause a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Integer Overflow

RCE

Weakness Enumeration

CWE-190

CWE-20

Related Identifiers

ALSA-2025_16880

ALT-PU-2023-1066

BDU:2025-01679

CVE-2022-48987

OPENSUSE-SU-2024_3983-1

OPENSUSE-SU-2024_3985-1

OPENSUSE-SU-2024_4131-1

SUSE-SU-2024:3983-1

SUSE-SU-2024:3985-1

SUSE-SU-2024:4082-1

SUSE-SU-2024:4131-1

SUSE-SU-2024:4364-1

Affected Products

Alt Linux

Astra Linux

Linux Kernel

Red Os

Suse

References · 999

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/48xxx/CVE-2022-48987.json · Exploit
• https://git.kernel.org/stable/c/5eef2141776da02772c44ec406d6871a790761ee · Patch
• https://osv.dev/vulnerability/SUSE-SU-2024:3985-1 · Vendor Advisory
• https://git.kernel.org/stable/c/6fb8bc29bfa80707994a63cc97e2f9920e0b0608 · Patch
• https://git.kernel.org/stable/c/32f01f0306a98629508f84d7ef0d1d037bc274a2 · Patch
• https://git.kernel.org/stable/c/d3d14cdf1c7ae2caa3e999bae95ba99e955fb7c3 · Patch
• https://cve.org/CVERecord?id=CVE-2022-48987 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2024:4364-1 · Vendor Advisory
• https://git.kernel.org/stable/c/2572ab14b73aa45b6ae7e4c089ccf119fed5cf89 · Patch
• https://git.kernel.org/stable/c/4afc77068e36cee45b39d4fdc7513de26980f72c · Patch
• https://git.kernel.org/stable/c/0d73b49c4037199472b29574ae21c21aef493971 · Patch
• https://ubuntu.com/security/CVE-2022-48987 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-48987 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-48987 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-01679 · Security Note