PT-2025-18568 · Linux+1 · Linux Kernel+1

Published

2022-11-10

·

Updated

2025-05-02

·

CVE-2022-49851

CVSS v3.1

7.1

High

VectorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.0.0-rc1-00001-g0d9d6953d834
Description A vulnerability in the Linux kernel has been resolved, specifically in the RISC-V architecture. The issue arises from the setup of reserved memory using the "early" copy of the device tree, which causes a kernel panic when trying to use the buffer's name. This is due to the pointer to reserved memory regions using the early, pre-virtual-memory address. The vulnerability is triggered when the of reserved mem lookup() function is called, and the vsnprintf() function is used with the incorrect address. The estimated number of potentially affected devices is not provided.
Technical details about the exploitation include:
  • The early init fdt scan reserved mem() function takes no arguments as it operates on initial boot params, which is populated by early init dt verify().
  • The early init dt verify() function is called twice in the RISC-V architecture, once directly in setup arch() and once indirectly in the boot process by parse dtb() when it calls early init dt scan nodes().
  • The first call uses dtb early va to set initial boot params, which is not usable later in the boot process when early init fdt scan reserved mem() is called.
  • The vsnprintf() function is used with the incorrect address, causing the kernel panic.
Recommendations To resolve the issue, move the early init fdt scan reserved mem() function further along the boot sequence, after the direct call to early init dt verify() in setup arch(), so that the names use the correct virtual memory addresses. This should work equally in cases where CONFIG BUILTIN DTB is set or not, as unflatted and copy device tree() also updates initial boot params.

Exploit

Fix

Out of bounds Read

Buffer Overflow

Weakness Enumeration

CWE-125CWE-119CWE-120

Related Identifiers

BDU:2026-03727
CVE-2022-49851

Affected Products

Astra Linux
Linux Kernel