CVE-2022-39842

2022-09-0715:49:15

redhat.com

access.redhat.com

linux kernel

pxa3xx_gcu_write

issue

cve-2022-39842

drivers/video/fbdev/pxa3xx-gcu.c

integer overflow

size check

heap overflow

copy_from_user()

CVSS3

6.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

19.0%

JSON

An issue was discovered in the Linux kernel before 5.19. In pxa3xx_gcu_write in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of size_t versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copy_from_user(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.