CVE-2022-49451 (GCVE-0-2022-49451)

Vulnerability from cvelistv5 – Published: 2025-02-26 02:13 – Updated: 2026-08-05 08:55
VLAI
Title
firmware: arm_scmi: Fix list protocols enumeration in the base protocol
Summary
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix list protocols enumeration in the base protocol While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition.
Severity
8.4 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-10-01 19:40 UTC
CWE
  • CWE-190 - Integer Overflow or Wraparound
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b6f20ff8bd94ad34032804a60bab5ee56752007e , < 444a2d27fe9867d0da4b28fc45b793f32e099ab8 (git)
Affected: b6f20ff8bd94ad34032804a60bab5ee56752007e , < b0e4bafac8963c2d85ee18d3d01f393735acceec (git)
Affected: b6f20ff8bd94ad34032804a60bab5ee56752007e , < 1052f22e127d0c34c3387bb389424ba1c61491ff (git)
Affected: b6f20ff8bd94ad34032804a60bab5ee56752007e , < 98342148a8cd242855d7e257f298c966c96dba9f (git)
Affected: b6f20ff8bd94ad34032804a60bab5ee56752007e , < 6e7978695f4a6cbd83616b5a702b77fa2087b247 (git)
Affected: b6f20ff8bd94ad34032804a60bab5ee56752007e , < 2ccfcd7a09c826516edcfe464b05071961aada3f (git)
Affected: b6f20ff8bd94ad34032804a60bab5ee56752007e , < 8009120e0354a67068e920eb10dce532391361d0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.17
Unaffected: 0 , < 4.17 (semver)
Unaffected: 4.19.247 , ≤ 4.19.* (semver)
Unaffected: 5.4.198 , ≤ 5.4.* (semver)
Unaffected: 5.10.121 , ≤ 5.10.* (semver)
Unaffected: 5.15.46 , ≤ 5.15.* (semver)
Unaffected: 5.17.14 , ≤ 5.17.* (semver)
Unaffected: 5.18.3 , ≤ 5.18.* (semver)
Unaffected: 5.19 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 5.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49451",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:40:29.513301Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-190",
                "description": "CWE-190 Integer Overflow or Wraparound",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:46:48.095Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "444a2d27fe9867d0da4b28fc45b793f32e099ab8",
              "status": "affected",
              "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
              "versionType": "git"
            },
            {
              "lessThan": "b0e4bafac8963c2d85ee18d3d01f393735acceec",
              "status": "affected",
              "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
              "versionType": "git"
            },
            {
              "lessThan": "1052f22e127d0c34c3387bb389424ba1c61491ff",
              "status": "affected",
              "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
              "versionType": "git"
            },
            {
              "lessThan": "98342148a8cd242855d7e257f298c966c96dba9f",
              "status": "affected",
              "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
              "versionType": "git"
            },
            {
              "lessThan": "6e7978695f4a6cbd83616b5a702b77fa2087b247",
              "status": "affected",
              "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
              "versionType": "git"
            },
            {
              "lessThan": "2ccfcd7a09c826516edcfe464b05071961aada3f",
              "status": "affected",
              "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
              "versionType": "git"
            },
            {
              "lessThan": "8009120e0354a67068e920eb10dce532391361d0",
              "status": "affected",
              "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/firmware/arm_scmi/base.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "lessThan": "4.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.247",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.198",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.121",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.18.*",
              "status": "unaffected",
              "version": "5.18.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.19",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.247",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.198",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.121",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.46",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.14",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18.3",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19",
                  "versionStartIncluding": "4.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix list protocols enumeration in the base protocol\n\nWhile enumerating protocols implemented by the SCMI platform using\nBASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is\ncurrently validated in an improper way since the check employs a sum\nbetween unsigned integers that could overflow and cause the check itself\nto be silently bypassed if the returned value \u0027loop_num_ret\u0027 is big\nenough.\n\nFix the validation avoiding the addition."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is reached only while processing local SCMI platform replies on mailbox/SMC/OP-TEE/virtio transports during base-protocol init (scmi_probe \u2192 scmi_protocol_acquire(BASE) \u2192 scmi_base_implementation_list_get); there is no network or adjacent-protocol path into this enumeration.\nAC:L - A malicious SCMI peer fully controls loop_num_ret and can deterministically return a small first batch then 0xFFFFFFFF so tot_num_ret + loop_num_ret wraps and bypasses the bounds check, with no race or attacker-uncontrollable condition.\nPR:N - Under the virtio-scmi and compromised-SCP threat models the attacker needs no guest/OS account or capability\u2014crafted BASE_DISCOVER_LIST_PROTOCOLS responses are consumed automatically at probe with no authentication on the Linux side.\nUI:N - Base-protocol enumeration runs automatically during SCMI device probe at boot/hotplug; no victim mount, open, or other interactive step is required.\nS:U - The resulting heap corruption stays inside the host/guest kernel\u2019s own security authority; this is not a guest-to-host escape, IOMMU bypass, or Normal/Secure-world boundary cross.\nC:H - Bypassing the check drives an unbounded for-loop that both over-reads past the rx message buffer (list + loop) and corrupts adjacent heap via the 16-byte protocols_imp write, yielding disclosure primitives consistent with OOB/memory-corruption guidance.\nI:H - The same integer-overflow bypass produces a heap out-of-bounds write past the MAX_PROTOCOLS_IMP-sized protocols_imp allocation, which is an arbitrary-write/control-flow hijack primitive under kernel CVSS guidance.\nA:H - The huge post-wrap loop_num_ret inevitably faults on OOB read/write or corrupts allocator state into an oops/panic, so availability impact is High even without a full exploit."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:55:12.845Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8"
        },
        {
          "url": "https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceec"
        },
        {
          "url": "https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0"
        }
      ],
      "title": "firmware: arm_scmi: Fix list protocols enumeration in the base protocol",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49451",
    "datePublished": "2025-02-26T02:13:01.077Z",
    "dateReserved": "2025-02-26T02:08:31.572Z",
    "dateUpdated": "2026-08-05T08:55:12.845Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49451",
      "date": "2026-09-23",
      "epss": "0.00299",
      "percentile": "0.22844"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/arm_scmi/base.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "444a2d27fe9867d0da4b28fc45b793f32e099ab8",
                    "status": "affected",
                    "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b0e4bafac8963c2d85ee18d3d01f393735acceec",
                    "status": "affected",
                    "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1052f22e127d0c34c3387bb389424ba1c61491ff",
                    "status": "affected",
                    "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98342148a8cd242855d7e257f298c966c96dba9f",
                    "status": "affected",
                    "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6e7978695f4a6cbd83616b5a702b77fa2087b247",
                    "status": "affected",
                    "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2ccfcd7a09c826516edcfe464b05071961aada3f",
                    "status": "affected",
                    "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8009120e0354a67068e920eb10dce532391361d0",
                    "status": "affected",
                    "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/firmware/arm_scmi/base.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.17"
                  },
                  {
                    "lessThan": "4.17",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "4.19.*",
                    "status": "unaffected",
                    "version": "4.19.247",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.4.*",
                    "status": "unaffected",
                    "version": "5.4.198",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.121",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.18.*",
                    "status": "unaffected",
                    "version": "5.18.3",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.19",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1D618A3C-AEC5-4520-BBDB-002AC8CA3FED",
                    "versionEndExcluding": "4.19.247",
                    "versionStartIncluding": "4.17",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3EC49633-14DE-4EBD-BB80-76AE2E3EABB9",
                    "versionEndExcluding": "5.4.198",
                    "versionStartIncluding": "4.20",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "34ACD872-E5BC-401C-93D5-B357A62426E0",
                    "versionEndExcluding": "5.10.121",
                    "versionStartIncluding": "5.5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20D41697-0E8B-4B7D-8842-F17BF2AA21E1",
                    "versionEndExcluding": "5.15.46",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "15E2DD33-2255-4B76-9C15-04FF8CBAB252",
                    "versionEndExcluding": "5.17.14",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E122216-2E9E-4B3E-B7B8-D575A45BA3C2",
                    "versionEndExcluding": "5.18.3",
                    "versionStartIncluding": "5.18",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix list protocols enumeration in the base protocol\n\nWhile enumerating protocols implemented by the SCMI platform using\nBASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is\ncurrently validated in an improper way since the check employs a sum\nbetween unsigned integers that could overflow and cause the check itself\nto be silently bypassed if the returned value \u0027loop_num_ret\u0027 is big\nenough.\n\nFix the validation avoiding the addition."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: firmware: arm_scmi: Se corrige la enumeraci\u00f3n de protocolos de lista en el protocolo base Al enumerar protocolos implementados por la plataforma SCMI utilizando BASE_DISCOVER_LIST_PROTOCOLS, la cantidad de protocolos devueltos actualmente se valida de manera incorrecta ya que la verificaci\u00f3n emplea una suma entre n\u00fameros enteros sin signo que podr\u00eda desbordarse y hacer que la verificaci\u00f3n en s\u00ed se omita silenciosamente si el valor devuelto \u0027loop_num_ret\u0027 es lo suficientemente grande. Arregle la validaci\u00f3n evitando la suma."
          }
        ],
        "id": "CVE-2022-49451",
        "lastModified": "2026-08-04T10:17:48.180",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.4,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 5.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 3.6,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-49451",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:40:29.513301Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-02-26T07:01:21.490",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceec"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-190"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:43:22+00:00",
      "cve": "CVE-2022-49451",
      "id": "CVE-2022-49451",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "367",
      "product_status:known_not_affected": "188",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: firmware: arm_scmi: Fix list protocols enumeration in the base protocol",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49451.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-13T23:50:51Z",
      "cve": "CVE-2022-49451",
      "id": "CVE-2022-49451",
      "initial_release_date": "2025-02-27T03:06:39Z",
      "product_status:known_affected": "360",
      "product_status:known_not_affected": "343",
      "product_status:recommended": "320",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49451",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49451.json",
      "version": "51"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "LOCAL",
                  "availabilityImpact": "HIGH",
                  "baseScore": 5.5,
                  "baseSeverity": "MEDIUM",
                  "confidentialityImpact": "NONE",
                  "integrityImpact": "NONE",
                  "privilegesRequired": "LOW",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-49451",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-01T19:40:29.513301Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-190",
                    "description": "CWE-190 Integer Overflow or Wraparound",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-01T16:47:23.911Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/firmware/arm_scmi/base.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "444a2d27fe9867d0da4b28fc45b793f32e099ab8",
                  "status": "affected",
                  "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                  "versionType": "git"
                },
                {
                  "lessThan": "b0e4bafac8963c2d85ee18d3d01f393735acceec",
                  "status": "affected",
                  "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                  "versionType": "git"
                },
                {
                  "lessThan": "1052f22e127d0c34c3387bb389424ba1c61491ff",
                  "status": "affected",
                  "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                  "versionType": "git"
                },
                {
                  "lessThan": "98342148a8cd242855d7e257f298c966c96dba9f",
                  "status": "affected",
                  "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                  "versionType": "git"
                },
                {
                  "lessThan": "6e7978695f4a6cbd83616b5a702b77fa2087b247",
                  "status": "affected",
                  "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                  "versionType": "git"
                },
                {
                  "lessThan": "2ccfcd7a09c826516edcfe464b05071961aada3f",
                  "status": "affected",
                  "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                  "versionType": "git"
                },
                {
                  "lessThan": "8009120e0354a67068e920eb10dce532391361d0",
                  "status": "affected",
                  "version": "b6f20ff8bd94ad34032804a60bab5ee56752007e",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/firmware/arm_scmi/base.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "4.17"
                },
                {
                  "lessThan": "4.17",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "4.19.*",
                  "status": "unaffected",
                  "version": "4.19.247",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.4.*",
                  "status": "unaffected",
                  "version": "5.4.198",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.121",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.46",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.17.*",
                  "status": "unaffected",
                  "version": "5.17.14",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.18.*",
                  "status": "unaffected",
                  "version": "5.18.3",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "5.19",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "4.19.247",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.4.198",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.121",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.46",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.17.14",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.18.3",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19",
                      "versionStartIncluding": "4.17",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfirmware: arm_scmi: Fix list protocols enumeration in the base protocol\n\nWhile enumerating protocols implemented by the SCMI platform using\nBASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is\ncurrently validated in an improper way since the check employs a sum\nbetween unsigned integers that could overflow and cause the check itself\nto be silently bypassed if the returned value \u0027loop_num_ret\u0027 is big\nenough.\n\nFix the validation avoiding the addition."
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-11T19:00:07.931Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8"
            },
            {
              "url": "https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceec"
            },
            {
              "url": "https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff"
            },
            {
              "url": "https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9f"
            },
            {
              "url": "https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247"
            },
            {
              "url": "https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f"
            },
            {
              "url": "https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0"
            }
          ],
          "title": "firmware: arm_scmi: Fix list protocols enumeration in the base protocol",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-49451",
        "datePublished": "2025-02-26T02:13:01.077Z",
        "dateReserved": "2025-02-26T02:08:31.572Z",
        "dateUpdated": "2026-05-11T19:00:07.931Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.