PT-2025-13282 · Linux+3 · Linux Kernel+3

Published 2025-03-27 · Updated 2025-05-29 · CVE-2022-49740

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-out-of-bounds read issue has been identified in the Linux kernel, specifically in the brcmfmac module. This issue occurs when the count value of channel specifications provided by the device exceeds the length of 'list->element[]', leading to out-of-bounds reads in the brcmf construct chaninfo() and brcmf enable bw40 2g() functions. The patch adds checks to prevent this issue by freeing the buffer and returning -EINVAL if the count value is greater than the length of 'list->element[]'. The issue was discovered using a modified version of syzkaller.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Out of bounds Read

Use After Free

Weakness Enumeration

CWE-125

CWE-416

Related Identifiers

BDU:2025-06292

CVE-2022-49740

OESA-2025-1432

SUSE-SU-2025:1293-1

SUSE-SU-2025_1293-1

Affected Products

Astra Linux

Linux Kernel

Red Os

Suse

References · 507

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49740.json · Exploit
• https://cve.org/CVERecord?id=CVE-2022-49740 · Security Note
• https://git.kernel.org/stable/c/4920ab131b2dbae7464b72bdcac465d070254209 · Patch
• https://git.kernel.org/stable/c/9cf5e99c1ae1a85286a76c9a970202750538394c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49740 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1432 · Vendor Advisory
• https://git.kernel.org/stable/c/e4991910f15013db72f6ec0db7038ea67a57052e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49307 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-49740 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-49740 · Vendor Advisory
• https://git.kernel.org/stable/c/f06de1bb6d61f0c18b0213bbc6298960037f9d42 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-49280 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-52973 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-49740 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-49399 · Security Note