CVE-2022-49122

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49122
In the Linux kernel, the following vulnerability has been resolved: dm ioctl: prevent potential spectre v1 gadget It appears like cmd could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/02cc46f397eb3691c56affbd5073e54f7a82ac32 Patch
https://git.kernel.org/stable/c/0320bac5801b31407200227173205d017488f140 Patch
https://git.kernel.org/stable/c/44e6cb3ab177faae840bb2c1ebda9a2539876184 Patch
https://git.kernel.org/stable/c/58880025e3362024f6d8ea01cb0c7a5df6c84ba6 Patch
https://git.kernel.org/stable/c/71c8df33fd777c7628f6fbc09b14e84806c55914 Patch
https://git.kernel.org/stable/c/76c94651005f58885facf9c973007f5ea01ab01f Patch
https://git.kernel.org/stable/c/7ae2c5b89da3cfaf856df880af27d3bb32a74b3d Patch
https://git.kernel.org/stable/c/cd9c88da171a62c4b0f1c70e50c75845969fbc18 Patch
https://git.kernel.org/stable/c/dd86064417de828ff2102ddc6049c829bf7585b4 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

14 Oct 2025, 19:56

Type Values Removed Values Added
First Time Linux
Linux linux Kernel
References () https://git.kernel.org/stable/c/02cc46f397eb3691c56affbd5073e54f7a82ac32 - () https://git.kernel.org/stable/c/02cc46f397eb3691c56affbd5073e54f7a82ac32 - Patch
References () https://git.kernel.org/stable/c/0320bac5801b31407200227173205d017488f140 - () https://git.kernel.org/stable/c/0320bac5801b31407200227173205d017488f140 - Patch
References () https://git.kernel.org/stable/c/44e6cb3ab177faae840bb2c1ebda9a2539876184 - () https://git.kernel.org/stable/c/44e6cb3ab177faae840bb2c1ebda9a2539876184 - Patch
References () https://git.kernel.org/stable/c/58880025e3362024f6d8ea01cb0c7a5df6c84ba6 - () https://git.kernel.org/stable/c/58880025e3362024f6d8ea01cb0c7a5df6c84ba6 - Patch
References () https://git.kernel.org/stable/c/71c8df33fd777c7628f6fbc09b14e84806c55914 - () https://git.kernel.org/stable/c/71c8df33fd777c7628f6fbc09b14e84806c55914 - Patch
References () https://git.kernel.org/stable/c/76c94651005f58885facf9c973007f5ea01ab01f - () https://git.kernel.org/stable/c/76c94651005f58885facf9c973007f5ea01ab01f - Patch
References () https://git.kernel.org/stable/c/7ae2c5b89da3cfaf856df880af27d3bb32a74b3d - () https://git.kernel.org/stable/c/7ae2c5b89da3cfaf856df880af27d3bb32a74b3d - Patch
References () https://git.kernel.org/stable/c/cd9c88da171a62c4b0f1c70e50c75845969fbc18 - () https://git.kernel.org/stable/c/cd9c88da171a62c4b0f1c70e50c75845969fbc18 - Patch
References () https://git.kernel.org/stable/c/dd86064417de828ff2102ddc6049c829bf7585b4 - () https://git.kernel.org/stable/c/dd86064417de828ff2102ddc6049c829bf7585b4 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE NVD-CWE-noinfo
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: dm ioctl: evitar un posible gadget de Spectre v1 Parece que cmd podría ser un gadget de Spectre v1, ya que lo proporciona un usuario y lo utiliza como índice de matriz. Evite que el contenido de la memoria del kernel se filtre al espacio de usuario mediante una ejecución especulativa utilizando array_index_nospec.

26 Feb 2025, 07:00

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:00

Updated : 2025-10-14 19:56

NVD link : CVE-2022-49122

Mitre link : CVE-2022-49122

CVE.ORG link : CVE-2022-49122

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo