CVE-2022-49289CWE-190

CVE-2022-49289

High · published February 26, 2025

CVSS v3.1
7.8
EPSS
0%
Percentile
18.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

uaccess: fix integer overflow on access_ok()

Three architectures check the end of a user access against the

address limit without taking a possible overflow into account.

Passing a negative length or another overflow in here returns

success when it should not.

Use the most common correct implementation here, which optimizes

for a constant 'size' argument, and turns the common case into a

single comparison.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00275 · 18.9th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2025-02-26T12:01Z
Affected products (3)
ProductVersionsFixed in
linux/linux_kernel≥ 3.2, < 5.15.325.15.32
linux/linux_kernel≥ 5.16, < 5.16.185.16.18
linux/linux_kernelall versions—
References (4)
EPSS history
Timeline
  • 26 FEB 01:56Z
    uaccess: fix integer overflow on access_ok()
    cvelistv5