« Volver al listado

CVE-2022-49948

Estado: ModificadaAlta (7.1)—

In the Linux kernel, the following vulnerability has been resolved:

vt: Clear selection before changing the font

When changing the console font with ioctl(KDFONTOP) the new font size can be bigger than the previous font. A previous selection may thus now be outside of the new screen size and thus trigger out-of-bounds accesses to graphics memory if the selection is removed in vc_do_resize().

Prevent such out-of-memory accesses by dropping the selection before the various con_font_set() console handlers are called.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L/PR:L sin UI confirma escalada local (T1068). Out-of-bounds en memoria gráfica permite ejecución de código (T1059) o denegación de servicio (T1499.004).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationFilter Network Traffic

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-49948",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "c555cf04684fde39b5b0dd9fd80730030ee10c4a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "e9ba4611ddf676194385506222cce7b0844e708e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "f74b4a41c5d7c9522469917e3072e55d435efd9e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "1cf1930369c9dc428d827b60260c53271bff3285",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "989201bb8c00b222235aff04e6200230d29dc7bb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "2535431ae967ad17585513649625fea7db28d4db",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "c904fe03c4bd1f356a58797d39e2a5d0ca15cefc",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "009e39ae44f4191188aeb6dfbf661b771dbbe515",
              "lessThan": "566f9c9f89337792070b5a6062dff448b3e7977f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e60f8fcce05042e8f8cea25ee81fecc1222114cf",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5812a9bc9d68a82c2cc839f88e6f7a05093ab39d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "863ad19fd654c485e3beec3575c4d74a1e74369e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "dbc3fd44f957a39407e889287bf61fa0ef3ecc14",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0b2a0a58ad22f9d6dfc641bc5ec46057493f22a5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9f2d48f0745f921040df91bfe8fa7f0339cd7497",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3425e397fb23cc2e8e6fb8f5b8226dcb447e84dd",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "eeae0a12a16650ff494d5faefa371cd9e7079575",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "3.2.85",
              "lessThan": "3.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.10.105",
              "lessThan": "3.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.12.68",
              "lessThan": "3.13",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.16.40",
              "lessThan": "3.17",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "3.18.45",
              "lessThan": "3.19",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.1.36",
              "lessThan": "4.2",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.4.31",
              "lessThan": "4.5",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "4.8.7",
              "lessThan": "4.9",
              "versionType": "semver"
            }
          ],
          "programFiles": [
            "drivers/tty/vt/vt.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.9"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.9",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.9.328",
              "versionType": "semver",
              "lessThanOrEqual": "4.9.*"
            },
            {
              "status": "unaffected",
              "version": "4.14.293",
              "versionType": "semver",
              "lessThanOrEqual": "4.14.*"
            },
            {
              "status": "unaffected",
              "version": "4.19.258",
              "versionType": "semver",
              "lessThanOrEqual": "4.19.*"
            },
            {
              "status": "unaffected",
              "version": "5.4.213",
              "versionType": "semver",
              "lessThanOrEqual": "5.4.*"
            },
            {
              "status": "unaffected",
              "version": "5.10.142",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.66",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "5.19.8",
              "versionType": "semver",
              "lessThanOrEqual": "5.19.*"
            },
            {
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "drivers/tty/vt/vt.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-06-18T11:15:21.827",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/1cf1930369c9dc428d827b60260c53271bff3285",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2535431ae967ad17585513649625fea7db28d4db",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/566f9c9f89337792070b5a6062dff448b3e7977f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/989201bb8c00b222235aff04e6200230d29dc7bb",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c555cf04684fde39b5b0dd9fd80730030ee10c4a",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c904fe03c4bd1f356a58797d39e2a5d0ca15cefc",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e9ba4611ddf676194385506222cce7b0844e708e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f74b4a41c5d7c9522469917e3072e55d435efd9e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nvt: Clear selection before changing the font\n\nWhen changing the console font with ioctl(KDFONTOP) the new font size\ncan be bigger than the previous font. A previous selection may thus now\nbe outside of the new screen size and thus trigger out-of-bounds\naccesses to graphics memory if the selection is removed in\nvc_do_resize().\n\nPrevent such out-of-memory accesses by dropping the selection before the\nvarious con_font_set() console handlers are called."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: vt: Borrar la selección antes de cambiar la fuente. Al cambiar la fuente de la consola con ioctl(KDFONTOP), el nuevo tamaño de fuente puede ser mayor que el anterior. Por lo tanto, una selección anterior podría quedar fuera del nuevo tamaño de pantalla y, por lo tanto, provocar accesos fuera de los límites a la memoria gráfica si se elimina la selección en vc_do_resize(). Para evitar estos accesos fuera de memoria, elimine la selección antes de llamar a los controladores de consola con_font_set()."
    }
  ],
  "lastModified": "2026-08-04T10:18:00.577",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "82C9EA22-96BE-488C-A979-0A1FBD90A0AE",
              "versionEndExcluding": "4.9.328"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D9B742D-912D-4E0C-A42F-367086FDEA88",
              "versionEndExcluding": "4.14.293",
              "versionStartIncluding": "4.10"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "253D30F5-3734-4663-883A-288786D3B66E",
              "versionEndExcluding": "4.19.258",
              "versionStartIncluding": "4.15"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C373116-9E23-44BA-A6B7-87C8BF5C3B85",
              "versionEndExcluding": "5.4.213",
              "versionStartIncluding": "4.20"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D44AD643-5591-432E-BD41-C2C737F54AC0",
              "versionEndExcluding": "5.10.142",
              "versionStartIncluding": "5.5"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52AE7E2B-7BE3-4B8A-89CC-AB62434899A3",
              "versionEndExcluding": "5.15.66",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7FEC7656-4CE2-424C-8830-EDB160E701C8",
              "versionEndExcluding": "5.19.8",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5F0AD220-F6A9-4012-8636-155F1B841FAD"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A46498B3-78E1-4623-AAE1-94D29A42BE4E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}