#VU104883 Buffer overflow in Linux kernel - CVE-2022-49642

Vulnerability identifier: #VU104883

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49642

CWE-ID: CWE-119

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the tegra_eqos_init() function in drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/029c1c2059e9c4b38f97a06204cdecd10cfbeb8a
https://git.kernel.org/stable/c/2968830c9b47ce093237483c6207c61065712386
https://git.kernel.org/stable/c/9cc8edc571b871d974b3289868553f9ce544aba6
https://git.kernel.org/stable/c/cfa4caf3e881ad6dd366c903c34f1c7f21b857ab
https://git.kernel.org/stable/c/d5c315a787652c35045044877a249f7d5c8a4104

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.