CVE-2022-49946

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49946
In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Prevent out-of-bounds access The while loop in raspberrypi_discover_clocks() relies on the assumption that the id of the last clock element is zero. Because this data comes from the Videocore firmware and it doesn't guarantuee such a behavior this could lead to out-of-bounds access. So fix this by providing a sentinel element.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/bc163555603e4ae9c817675ad80d618a4cdbfa2d Patch
https://git.kernel.org/stable/c/c8b04b731d43366824841ebdca4ac715f95e0ea4 Patch
https://git.kernel.org/stable/c/fcae47b2d23c81603b01f56cf8db63ed64599d34 Patch
https://git.kernel.org/stable/c/ff0b144d4b0a9fbd6efe4d2c0a4b6c9bae2138d2 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
History

14 Nov 2025, 19:43

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: clk: bcm: rpi: Impedir acceso fuera de los límites. El bucle while en raspberrypi_discover_clocks() asume que el ID del último elemento de reloj es cero. Dado que estos datos provienen del firmware de Videocore y no garantizan dicho comportamiento, esto podría provocar un acceso fuera de los límites. Para solucionarlo, se debe proporcionar un elemento centinela.
References () https://git.kernel.org/stable/c/bc163555603e4ae9c817675ad80d618a4cdbfa2d - () https://git.kernel.org/stable/c/bc163555603e4ae9c817675ad80d618a4cdbfa2d - Patch
References () https://git.kernel.org/stable/c/c8b04b731d43366824841ebdca4ac715f95e0ea4 - () https://git.kernel.org/stable/c/c8b04b731d43366824841ebdca4ac715f95e0ea4 - Patch
References () https://git.kernel.org/stable/c/fcae47b2d23c81603b01f56cf8db63ed64599d34 - () https://git.kernel.org/stable/c/fcae47b2d23c81603b01f56cf8db63ed64599d34 - Patch
References () https://git.kernel.org/stable/c/ff0b144d4b0a9fbd6efe4d2c0a4b6c9bae2138d2 - () https://git.kernel.org/stable/c/ff0b144d4b0a9fbd6efe4d2c0a4b6c9bae2138d2 - Patch
CPE cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
CWE CWE-125
First Time Linux
Linux linux Kernel

18 Jun 2025, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-06-18 11:15

Updated : 2025-11-14 19:43

NVD link : CVE-2022-49946

Mitre link : CVE-2022-49946

CVE.ORG link : CVE-2022-49946

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read