CVE-2022-49500

CVE-2022-49500

High · published February 26, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
18.3
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

wl1251: dynamically allocate memory used for DMA

With introduction of vmap'ed stacks, stack parameters can no

longer be used for DMA and now leads to kernel panic.

It happens at several places for the wl1251 (e.g. when

accessed through SDIO) making it unuseable on e.g. the

OpenPandora.

We solve this by allocating temporary buffers or use wl1251_read32().

Tested on v5.18-rc5 with OpenPandora.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00271 · 18.3th percentile
Published
2025-02-26T12:01Z
Affected products (1)
ProductVersionsFixed in
linux/linux_kernel≥ 5.18, < 5.18.35.18.3
References (2)
EPSS history
Timeline
  • 26 FEB 02:13Z
    wl1251: dynamically allocate memory used for DMA
    cvelistv5