CVE-2022-48655: firmware: arm_scmi: Harden accesses to the reset domains
In the Linux kernel, the following vulnerability has been resolved:
firmware: armscmi: Harden accesses to the reset domains
Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave.
Add an internal consistency check before any such domains descriptors accesses.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48655?
CVE-2022-48655 has a medium severity level due to its potential impact on the security of the Linux kernel.
How do I fix CVE-2022-48655?
To fix CVE-2022-48655, update to patched versions of the Linux kernel such as 5.10.223-1, 6.1.119-1, or later.
Which Linux kernel versions are affected by CVE-2022-48655?
CVE-2022-48655 affects Linux kernel versions from 5.4 up to 6.0-rc6 across various distributions.
What does CVE-2022-48655 affect specifically in the Linux kernel?
CVE-2022-48655 affects the SCMI drivers that handle reset operations, potentially exposing reset domain descriptors.
Is there a CVE-2022-48655 fix available for Debian systems?
Yes, Debian users can upgrade to the linux package versions 5.10.223-1 or higher to address CVE-2022-48655.