CVE-2022-49035 - media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE · CoreCVE

Back Back to CVE browser

MEDIUM

media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

Published Jan 2, 2025

5.5

MEDIUM

CVSS 3.1

EPSS 0.21%

Description

I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  4.8
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <4.8
- Version
  4.14.299
  Status
  unaffected
  Constraints
  <=4.14.*
- Version
  4.19.265
  Status
  unaffected
  Constraints
  <=4.19.*
- Version
  4.9.333
  Status
  unaffected
  Constraints
  <=4.9.*
- Version
  5.10.154
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.78
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  5.4.224
  Status
  unaffected
  Constraints
  <=5.4.*
- Version
  6.0.8
  Status
  unaffected
  Constraints
  <=6.0.*
- Version
  6.1
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected
	affected
	affected
	affected
	affected

affected

Version	Status	Constraints
4.8	affected	-
0	unaffected	<4.8
4.14.299	unaffected	<=4.14.*
4.19.265	unaffected	<=4.19.*
4.9.333	unaffected	<=4.9.*
5.10.154	unaffected	<=5.10.*
5.15.78	unaffected	<=5.15.*
5.4.224	unaffected	<=5.4.*
6.0.8	unaffected	<=6.0.*
6.1	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-770

Allocation of Resources Without Limits

References (14)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-49035		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2335291		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53918		Advisory
https://git.kernel.org/stable/c/1609231f86760c1f6a429de7913dd795b9faa08c		Patch
https://git.kernel.org/stable/c/2654e785bd4aa2439cdffbe7dc1ea30a0eddbfe4		Patch
https://git.kernel.org/stable/c/4a449430ecfb199b99ba58af63c467eb53500b39		Patch
https://git.kernel.org/stable/c/7ccb40f26cbefa1c6dfd3418bea54c9518cdbd8a		Patch
https://git.kernel.org/stable/c/93f65ce036863893c164ca410938e0968964b26c		Patch
https://git.kernel.org/stable/c/a2728bf9b6c65e46468c763e3dab7e04839d4e11		Patch
https://git.kernel.org/stable/c/cbfa26936f318b16ccf9ca31b8e8b30c0dc087bd		Patch
https://git.kernel.org/stable/c/fc0f76dd5f116fa9291327024dda392f8b4e849c		Patch
https://lore.kernel.org/linux-cve-announce/2025010208-CVE-2022-49035-5a59@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-49035
https://www.cve.org/CVERecord?id=CVE-2022-49035

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner Linux

Published Jan 2, 2025

Updated May 11, 2026

Reserved Aug 22, 2024

Link CVE-2022-49035

CISA Vulnrichment

Updated Oct 1, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-49035

Severity Moderate

Public date Jan 2, 2025

Links CVE-2022-49035 - Bugzilla

Assigner Linux

Published Jan 2, 2025

Updated May 11, 2026

Exploited since n/a

Link EUVD-2022-53918

EUVD-2022-53918