CVE-2022-49451 Details
Description
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix list protocols enumeration in the base protocol While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition.
A vulnerability in the Linux kernel's handling of the ARM SCMI base protocol enumeration has been addressed. The issue arose because the validation of the number of protocols returned by the BASE_DISCOVER_LIST_PROTOCOLS command was flawed. The check used a sum of unsigned integers that could overflow, potentially allowing the validation to be bypassed if the returned value was sufficiently large. The vulnerability has been fixed by improving the validation process to avoid such overflow issues.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 1, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff | kernel.org | Patch |
| https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f | kernel.org | Patch |
| https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247 | kernel.org | Patch |
| https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9f | kernel.org | Patch |
| https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceec | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.17, < 4.19.247 >= 4.20, < 5.4.198 >= 5.5, < 5.10.121 >= 5.11, < 5.15.46 >= 5.16, < 5.17.14 >= 5.18, < 5.18.3 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 4, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Oct 1, 2025 | CVE Modified | CISA-ADP |
| Mar 17, 2025 | Initial Analysis | [email protected] |
| Feb 26, 2025 | New CVE Received | kernel.org |