CVE-2022-49952 (GCVE-0-2022-49952)

Vulnerability from cvelistv5 – Published: 2025-06-18 11:00 – Updated: 2026-08-05 08:56
VLAI
Title
misc: fastrpc: fix memory corruption on probe
Summary
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix memory corruption on probe Add the missing sanity check on the probed-session count to avoid corrupting memory beyond the fixed-size slab-allocated session array when there are more than FASTRPC_MAX_SESSIONS sessions defined in the devicetree.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 , < ec186b9f4aa2e6444d5308a6cc268aada7007639 (git)
Affected: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 , < c99bc901d5eb9fbdd7bd39f625e170ce97390336 (git)
Affected: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 , < 0e33b0f322fecd7a92d9dc186535cdf97940a856 (git)
Affected: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 , < c0425c2facd9166fa083f90c9f3187ace0c7837a (git)
Affected: f6f9279f2bf0e37e2f1fb119d8832b8568536a04 , < 9baa1415d9abdd1e08362ea2dcfadfacee8690b5 (git)
Create a notification for this product.
Linux Linux Affected: 5.1
Unaffected: 0 , < 5.1 (semver)
Unaffected: 5.4.213 , ≤ 5.4.* (semver)
Unaffected: 5.10.142 , ≤ 5.10.* (semver)
Unaffected: 5.15.66 , ≤ 5.15.* (semver)
Unaffected: 5.19.8 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ec186b9f4aa2e6444d5308a6cc268aada7007639",
              "status": "affected",
              "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
              "versionType": "git"
            },
            {
              "lessThan": "c99bc901d5eb9fbdd7bd39f625e170ce97390336",
              "status": "affected",
              "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
              "versionType": "git"
            },
            {
              "lessThan": "0e33b0f322fecd7a92d9dc186535cdf97940a856",
              "status": "affected",
              "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
              "versionType": "git"
            },
            {
              "lessThan": "c0425c2facd9166fa083f90c9f3187ace0c7837a",
              "status": "affected",
              "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
              "versionType": "git"
            },
            {
              "lessThan": "9baa1415d9abdd1e08362ea2dcfadfacee8690b5",
              "status": "affected",
              "version": "f6f9279f2bf0e37e2f1fb119d8832b8568536a04",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/misc/fastrpc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.1"
            },
            {
              "lessThan": "5.1",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.213",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.142",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.66",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.213",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.142",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.66",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.8",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmisc: fastrpc: fix memory corruption on probe\n\nAdd the missing sanity check on the probed-session count to avoid\ncorrupting memory beyond the fixed-size slab-allocated session array\nwhen there are more than FASTRPC_MAX_SESSIONS sessions defined in the\ndevicetree."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the Qualcomm FastRPC platform compute-cb probe path during local DSP/rpmsg bring-up, not reachable via network packets or adjacent-link protocols.\nAC:L - On realistic Qualcomm device trees such as SC8280XP with 14 CDSP context banks (when FASTRPC_MAX_SESSIONS was 13) or oversized qcom,nsessions, probe reliably performs the out-of-bounds session array write with no attacker-uncontrollable race.\nPR:L - fastrpc_cb_probe runs from trusted DT during device bring-up without a capability gate; on primary Android/Qualcomm deployments the resulting kernel corruption is then reachable by low-privilege local processes using the fastrpc device nodes.\nUI:N - Exploitation requires no victim action; the overflow is triggered automatically when the compute-cb devices are probed.\nS:U - Impact is confined to kernel memory in the same host OS security authority (local privilege escalation), with no VM or IOMMU boundary crossed.\nC:H - The out-of-bounds write past the fixed session array corrupts adjacent channel_ctx fields (including idr and list pointers), which can be leveraged for arbitrary kernel memory disclosure.\nI:H - Out-of-bounds write into the spinlock, idr, and users list immediately following the session array enables classic kernel heap/list corruption primitives for arbitrary write and control-flow hijacking.\nA:H - Corrupting the channel spinlock, idr, or list_head reliably causes kernel oops, panic, or hangs when those structures are subsequently used."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:52.538Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ec186b9f4aa2e6444d5308a6cc268aada7007639"
        },
        {
          "url": "https://git.kernel.org/stable/c/c99bc901d5eb9fbdd7bd39f625e170ce97390336"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e33b0f322fecd7a92d9dc186535cdf97940a856"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0425c2facd9166fa083f90c9f3187ace0c7837a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9baa1415d9abdd1e08362ea2dcfadfacee8690b5"
        }
      ],
      "title": "misc: fastrpc: fix memory corruption on probe",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49952",
    "datePublished": "2025-06-18T11:00:15.434Z",
    "dateReserved": "2025-06-18T10:57:27.382Z",
    "dateUpdated": "2026-08-05T08:56:52.538Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49952",
      "date": "2026-08-13",
      "epss": "0.00206",
      "percentile": "0.10896"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49952\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T11:15:22.277\",\"lastModified\":\"2026-08-04T10:18:00.870\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmisc: fastrpc: fix memory corruption on probe\\n\\nAdd the missing sanity check on the probed-session count to avoid\\ncorrupting memory beyond the fixed-size slab-allocated session array\\nwhen there are more than FASTRPC_MAX_SESSIONS sessions defined in the\\ndevicetree.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: misc: fastrpc: corregir corrupci\u00f3n de memoria en la sonda Agregue la verificaci\u00f3n de cordura faltante en el recuento de sesiones sondeadas para evitar corromper la memoria m\u00e1s all\u00e1 de la matriz de sesiones asignadas por bloques de tama\u00f1o fijo cuando hay m\u00e1s de FASTRPC_MAX_SESSIONS sesiones definidas en el \u00e1rbol de dispositivos.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/misc/fastrpc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f6f9279f2bf0e37e2f1fb119d8832b8568536a04\",\"lessThan\":\"ec186b9f4aa2e6444d5308a6cc268aada7007639\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6f9279f2bf0e37e2f1fb119d8832b8568536a04\",\"lessThan\":\"c99bc901d5eb9fbdd7bd39f625e170ce97390336\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6f9279f2bf0e37e2f1fb119d8832b8568536a04\",\"lessThan\":\"0e33b0f322fecd7a92d9dc186535cdf97940a856\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6f9279f2bf0e37e2f1fb119d8832b8568536a04\",\"lessThan\":\"c0425c2facd9166fa083f90c9f3187ace0c7837a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f6f9279f2bf0e37e2f1fb119d8832b8568536a04\",\"lessThan\":\"9baa1415d9abdd1e08362ea2dcfadfacee8690b5\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/misc/fastrpc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.1\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.1\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.213\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.142\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.66\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.8\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.1\",\"versionEndExcluding\":\"5.4.213\",\"matchCriteriaId\":\"4F0B32F6-E2D6-4C72-9760-7F18CA134535\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.142\",\"matchCriteriaId\":\"D44AD643-5591-432E-BD41-C2C737F54AC0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.66\",\"matchCriteriaId\":\"52AE7E2B-7BE3-4B8A-89CC-AB62434899A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.8\",\"matchCriteriaId\":\"7FEC7656-4CE2-424C-8830-EDB160E701C8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AD220-F6A9-4012-8636-155F1B841FAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A46498B3-78E1-4623-AAE1-94D29A42BE4E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e33b0f322fecd7a92d9dc186535cdf97940a856\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/9baa1415d9abdd1e08362ea2dcfadfacee8690b5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c0425c2facd9166fa083f90c9f3187ace0c7837a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c99bc901d5eb9fbdd7bd39f625e170ce97390336\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ec186b9f4aa2e6444d5308a6cc268aada7007639\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:26:24+00:00",
      "cve": "CVE-2022-49952",
      "id": "CVE-2022-49952",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: misc: fastrpc: fix memory corruption on probe",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49952.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:12:08Z",
      "cve": "CVE-2022-49952",
      "id": "CVE-2022-49952",
      "initial_release_date": "2025-06-19T03:45:44Z",
      "product_status:known_affected": "358",
      "product_status:known_not_affected": "280",
      "product_status:recommended": "273",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49952",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49952.json",
      "version": "42"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.