Integer overflow in Linux kernel hw hfi1 driver

1) Integer overflow

EUVDB-ID: #VU104780

Risk: Low

CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49404

CWE-ID: CWE-190 - Integer overflow

Exploit availability: No

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to integer overflow within the set_link_ipg() function in drivers/infiniband/hw/hfi1/init.c. A local user can execute arbitrary code.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 4.9 - 5.19 rc6

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:4.9:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.0:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.1:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.2:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.3:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.4:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.5:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.6:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.7:*:*:*:*:*:*:*
• cpe:2.3:o:linux_foundation:linux_kernel:4.9.8:*:*:*:*:*:*:*

External links

https://git.kernel.org/stable/c/06039d8afefdbac05bcea5f397188407eba2996d
https://git.kernel.org/stable/c/252f4afd4557a2e7075f793a5c80fe6dd9e9ee4a
https://git.kernel.org/stable/c/31dca00d0cc9f4133320d72eb7e3720badc6d6e6
https://git.kernel.org/stable/c/3f09ec80f115d2875d747ed28adc1773037e0f8b
https://git.kernel.org/stable/c/79c164e61f818054cd6012e9035701840d895c51
https://git.kernel.org/stable/c/8858284dd74906fa00f04f0252c75df4893a7959
https://git.kernel.org/stable/c/a89cb7ddf6a89bab6012e19da38b7cdb26175c19
https://git.kernel.org/stable/c/ef5ab2e48a5f9960e2352332b7cdb7064bb49032
https://git.kernel.org/stable/c/f93e91a0372c922c20d5bee260b0f43b4b8a1bee
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.283
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.247
https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.318
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.10.121
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.15.46
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.14
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.18.3
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.19
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.198

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.