Log in Start free

Vulnerability · Published Jan 2, 2025 · Assigned by Linux

CVE-2022-49035media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

Medium 5.5

In plain English

A medium-severity resource allocation without limits in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 89.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.0.8-1DEBIAN-CVE-2022-49035
Debian:13linux6.0.8-1DEBIAN-CVE-2022-49035
Debian:14linux6.0.8-1DEBIAN-CVE-2022-49035
Ubuntu:22.04:LTSlinux5.15.0-60.66UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-aws5.15.0-1030.34UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-azure5.15.0-1033.40UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1033.40.1UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-gcp5.15.0-1029.36UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-gke5.15.0-1027.32UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1015.19UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-ibm5.15.0-1025.28UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1025.30UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-kvm5.15.0-1028.33UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-60.66UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1017.17UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-oracle5.15.0-1029.35UBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-raspi5.15.0-1024.26UBUNTU-CVE-2022-49035
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49035
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49035

Affected products (as reported)

VendorProductVersions
Linux Linux 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before 7ccb40f26cbefa1c6dfd3418bea54c9518cdbd8a1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before fc0f76dd5f116fa9291327024dda392f8b4e849c1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before a2728bf9b6c65e46468c763e3dab7e04839d4e111bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before 4a449430ecfb199b99ba58af63c467eb53500b391bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before 1609231f86760c1f6a429de7913dd795b9faa08c1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before cbfa26936f318b16ccf9ca31b8e8b30c0dc087bd1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before 2654e785bd4aa2439cdffbe7dc1ea30a0eddbfe41bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b – before 93f65ce036863893c164ca410938e0968964b26c
Linux Linux 4.8

Weakness: CWE-770 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References