CVE-2022-2873: Medium severity Linux Linux kernel vulnerability
A flaw out of bounds memory access found in the Intel iSMT SMBus host controller driver. If local user triggers I2CSMBUSBLOCKDATA (with the ioctl I2CSMBUS) with some malicious input data, it can lead to system crash. The problem located in ismtaccess() function of the drivers/i2c/busses/i2c-ismt.c.
Other sources
An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2CSMBUSBLOCKDATA (with the ioctl I2CSMBUS) with malicious input data. This flaw allows a local user to crash the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.13.1.rt7.223.el8_7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-425.13.1.el8_7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:4.18.0-372.75.1.el8_6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.18.1.el9_1 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:5.14.0-162.18.1.rt21.181.el9_1 - Upgrade
Upgrade
redhat/Linux kernelto a version that resolves this vulnerability.Fixed in 5.19 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.4-1 - Configuration
Blacklist the i2c-ismt kernel module to prevent it from being loaded automatically.
Linux kernel module i2c-ismt module loading = blacklisted
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2022-2873?
CVE-2022-2873 is classified with a high severity due to its potential to cause a system crash.
How do I fix CVE-2022-2873?
To fix CVE-2022-2873, update to the appropriate kernel versions specified in the remediation section.
What are the affected software for CVE-2022-2873?
CVE-2022-2873 affects several versions of the Linux kernel across different distributions such as Red Hat and Debian.
Can CVE-2022-2873 be exploited remotely?
CVE-2022-2873 requires local access for exploitation, making remote exploitation unlikely.
Is there a workaround for CVE-2022-2873?
No specific workaround is documented for CVE-2022-2873, so updating to a patched version is recommended.