Lucene search

Redhat.comRH:CVE-2022-40540

HistoryMar 21, 2023 - 4:13 p.m.

CVE-2022-40540

2023-03-2116:13:19

redhat.com

access.redhat.com

linux

kernel

memory corruption

qcom_mdt_read_metadata

firmware加载

buffer copy

input size

drivers/soc/qcom/mdt_loader.c

cve-2022-40540

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

A flaw was found in the Linux kernel. Memory corruption occurs to the buffer copy without checking the input size while loading firmware in qcom_mdt_read_metadata in drivers/soc/qcom/mdt_loader.c.

References

bugzilla.redhat.com/show_bug.cgi?id=2180513

docs.qualcomm.com/product/publicresources/securitybulletin/march-2023-bulletin.html

git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/dae3214cd3495e5c4b37537cacf665d2cdeaea24#2464dff2511258aa7a8f7fe202abd94f99350fa2

nvd.nist.gov/vuln/detail/CVE-2022-40540

www.cve.org/CVERecord?id=CVE-2022-40540

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for RH:CVE-2022-40540