CVE-2022-49885

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-49885
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49885.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49885
Downstream
Related
Published
2025-05-01T14:10:31.286Z
Modified
2026-04-11T11:56:46.938016Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()
Details

In the Linux kernel, the following vulnerability has been resolved:

ACPI: APEI: Fix integer overflow in ghesestatuspool_init()

Change num_ghes from int to unsigned int, preventing an overflow and causing subsequent vmalloc() to fail.

The overflow happens in ghesestatuspool_init() when calculating len during execution of the statement below as both multiplication operands here are signed int:

len += (numghes * GHESESOURCEPREALLOCMAX_SIZE);

The following call trace is observed because of this bug:

[ 9.317108] swapper/0: vmalloc error: size 18446744071562596352, exceeds total pages, mode:0xcc0(GFPKERNEL), nodemask=(null),cpuset=/,memsallowed=0-1 [ 9.317131] Call Trace: [ 9.317134] <TASK> [ 9.317137] dumpstacklvl+0x49/0x5f [ 9.317145] dumpstack+0x10/0x12 [ 9.317146] warnalloc.cold+0x7b/0xdf [ 9.317150] ? __device_attach+0x16a/0x1b0 [ 9.317155] __vmallocnoderange+0x702/0x740 [ 9.317160] ? deviceadd+0x17f/0x920 [ 9.317164] ? devset_name+0x53/0x70 [ 9.317166] ? platformdeviceadd+0xf9/0x240 [ 9.317168] _vmallocnode+0x49/0x50 [ 9.317170] ? ghesestatuspoolinit+0x43/0xa0 [ 9.317176] vmalloc+0x21/0x30 [ 9.317177] ghesestatuspoolinit+0x43/0xa0 [ 9.317179] acpihestinit+0x129/0x19c [ 9.317185] acpiinit+0x434/0x4a4 [ 9.317188] ? acpisleepprocinit+0x2a/0x2a [ 9.317190] dooneinitcall+0x48/0x200 [ 9.317195] kernelinitfreeable+0x221/0x284 [ 9.317200] ? restinit+0xe0/0xe0 [ 9.317204] kernelinit+0x1a/0x130 [ 9.317205] retfromfork+0x22/0x30 [ 9.317208] </TASK>

[ rjw: Subject and changelog edits ]

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49885.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
fb7be08f1a091ec243780bfdad4bf0c492057808
Fixed
9edf20e5a1d805855e78f241cf221d741b50d482
Fixed
c50ec15725e005e9fb20bce69b6c23b135a4a9b7
Fixed
4c10c854113720cbfe75d4f51db79b700a629e73
Fixed
43d2748394c3feb86c0c771466f5847e274fc043

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49885.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.1.0
Fixed
5.10.154
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.78
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.0.8

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49885.json"