CVE-2022-39842: Integer Overflow
DISPUTED An issue was discovered in the Linux kernel before 5.19. In pxa3xxgcuwrite in drivers/video/fbdev/pxa3xx-gcu.c, the count parameter has a type conflict of sizet versus int, causing an integer overflow and bypassing the size check. After that, because it is used as the third argument to copyfromuser(), a heap overflow may occur. NOTE: the original discoverer disputes that the overflow can actually happen.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 5.19
Event History
Frequently Asked Questions
What is the severity of CVE-2022-39842?
CVE-2022-39842 is classified as a medium severity vulnerability due to the potential for integer overflow.
How do I fix CVE-2022-39842?
To mitigate CVE-2022-39842, upgrade to a kernel version that is 5.19 or higher, or apply the relevant patches provided by your distribution.
Which software versions are affected by CVE-2022-39842?
CVE-2022-39842 affects Linux kernel versions before 5.19, including specific release candidates and certain Debian Linux distributions.
What type of vulnerability is CVE-2022-39842?
CVE-2022-39842 is an integer overflow vulnerability in the pxa3xx_gcu_write function of the Linux kernel.
Is there a known exploit for CVE-2022-39842?
As of now, there are no publicly available exploits reported for CVE-2022-39842, but its nature could allow for potential future exploitation.