« Volver al listado

CVE-2022-50185

Estado: AnalizadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

drm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()

The last case label can write two buffers 'mc_reg_address[j]' and 'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE since there are no checks for this value in both case labels after the last 'j++'.

Instead of changing '>' to '>=' there, add the bounds check at the start of the second 'case' (the first one already has it).

Also, remove redundant last checks for 'j' index bigger than array size. The expression is always false. Moreover, before or after the patch 'table->last' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it seems it can be a valid value.

Leer descripción completaMostrar menos

Detected using the static analysis tool - Svace.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de buffer overflow (CWE-787) en kernel de Linux con acceso local privilegiado (PR:L) sin interacción del usuario (UI:N). Permite ejecución de código en el contexto del kernel tras saltar controles de límites de array en el driver radeon.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-50185",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "ea73869df6ef386fc0feeb28ff66742ca835b18f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "1f341053852be76f82610ce47a505d930512f05c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "db1a9add3f90ff1c641974d5bb910c16b87af4ef",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "8508d6d23a247c29792ce2fc0df3f3404d6a6a80",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "deb603c5928e546609c0d5798e231d0205748943",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "782e413e38dffd37cc85b08b1ccb982adb4a93ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "9faff03617afeced1c4e5daa89e79b3906374342",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "69e0b57a91adca2e3eb56ed4db39ab90f3ae1043",
              "lessThan": "136f614931a2bb73616b292cf542da3a18daefd5",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/radeon/ni_dpm.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "3.11",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.14.291",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.256",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.211",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.137",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.61",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.18.18",
              "versionType": "semver",
              "lessThanOrEqual": "5.18.*"
            },
            {
              "status": "unaffected",
              "version": "5.19.2",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/gpu/drm/radeon/ni_dpm.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-18T11:15:49.030",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/136f614931a2bb73616b292cf542da3a18daefd5",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1f341053852be76f82610ce47a505d930512f05c",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/782e413e38dffd37cc85b08b1ccb982adb4a93ce",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8508d6d23a247c29792ce2fc0df3f3404d6a6a80",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9faff03617afeced1c4e5daa89e79b3906374342",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/db1a9add3f90ff1c641974d5bb910c16b87af4ef",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/deb603c5928e546609c0d5798e231d0205748943",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ea73869df6ef386fc0feeb28ff66742ca835b18f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/radeon: fix potential buffer overflow in ni_set_mc_special_registers()\n\nThe last case label can write two buffers 'mc_reg_address[j]' and\n'mc_data[j]' with 'j' offset equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE\nsince there are no checks for this value in both case labels after the\nlast 'j++'.\n\nInstead of changing '>' to '>=' there, add the bounds check at the start\nof the second 'case' (the first one already has it).\n\nAlso, remove redundant last checks for 'j' index bigger than array size.\nThe expression is always false. Moreover, before or after the patch\n'table->last' can be equal to SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE and it\nseems it can be a valid value.\n\nDetected using the static analysis tool - Svace."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: drm/radeon: corrige un desbordamiento de búfer potencial en ni_set_mc_special_registers() La última etiqueta de caso puede escribir dos búferes 'mc_reg_address[j]' y 'mc_data[j]' con el desplazamiento 'j' igual a SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE ya que no hay comprobaciones para este valor en ambas etiquetas de caso después del último 'j++'. En lugar de cambiar \">\" a \">=\" allí, agregue la comprobación de los límites al comienzo del segundo 'caso' (el primero ya lo tiene). Además, elimine las últimas comprobaciones redundantes para el índice 'j' mayor que el tamaño del arreglo. La expresión siempre es falsa. Además, antes o después del parche 'table->last' puede ser igual a SMC_NISLANDS_MC_REGISTER_ARRAY_SIZE y parece que puede ser un valor válido. Detectado usando la herramienta de análisis estático - Svace."
    }
  ],
  "lastModified": "2026-06-17T05:22:55.913",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55DA0D35-C6F8-459A-8AE2-F2D47F715333",
              "versionEndExcluding": "4.14.291",
              "versionStartIncluding": "3.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6C47CDE3-B039-4AE5-B8E4-1DC820E473FF",
              "versionEndExcluding": "4.19.256",
              "versionStartIncluding": "4.15"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1C63D19-C08C-4308-A848-B2523C9275BD",
              "versionEndExcluding": "5.4.211",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2BF720F-C5EE-4DE2-9BDF-CE4CFBC767F4",
              "versionEndExcluding": "5.10.137",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51861563-7F40-460F-82CD-2D3FBDAD6618",
              "versionEndExcluding": "5.15.61",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5B42E453-8837-49D0-A5EF-03F818A6DC11",
              "versionEndExcluding": "5.18.18",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1A2A5A5-4598-4D7E-BA07-4660398D6C8F",
              "versionEndExcluding": "5.19.2",
              "versionStartIncluding": "5.19"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}