Lucene search

K
nvd416baaa9-dc9f-4396-8d5f-8c081fb06d67NVD:CVE-2022-48657
HistoryApr 28, 2024 - 1:15 p.m.

CVE-2022-48657

2024-04-2813:15:07
CWE-120
416baaa9-dc9f-4396-8d5f-8c081fb06d67
web.nvd.nist.gov
6
linux kernel
vulnerability
cve-2022-48657
resolved
fix
overflow
amu_fie_setup
frequency mismatch
cpufreq_get_hw_max_freq
freq_inv_set_max_ratio
linux verification center
svace
static analysis tool

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0

Percentile

15.5%

In the Linux kernel, the following vulnerability has been resolved:

arm64: topology: fix possible overflow in amu_fie_setup()

cpufreq_get_hw_max_freq() returns max frequency in kHz as unsigned int,
while freq_inv_set_max_ratio() gets passed this frequency in Hz as ‘u64’.
Multiplying max frequency by 1000 can potentially result in overflow –
multiplying by 1000ULL instead should avoid that…

Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.

Affected configurations

Nvd
Node
linuxlinux_kernelRange5.75.10.150
OR
linuxlinux_kernelRange5.115.15.71
OR
linuxlinux_kernelRange5.165.19.12
VendorProductVersionCPE
linuxlinux_kernel*cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0

Percentile

15.5%