CVE-2022-1489
published 2022-07-26CVE-2022-1489: Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap…
PriorityP344high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.98%
58.8th percentile
Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 101.0.4951.41-1~deb11u1 | 101.0.4951.41-1~deb11u1 |
| chromium | chromium | >= 0 < 101.0.4951.41-1 | 101.0.4951.41-1 |
| chromium | chromium | >= 0 < 101.0.4951.41-1 | 101.0.4951.41-1 |
| chromium | chromium | >= 0 < 101.0.4951.41-1 | 101.0.4951.41-1 |
| debian | chromium | < chromium 101.0.4951.41-1 (bookworm) | chromium 101.0.4951.41-1 (bookworm) |
| chrome | < 101.0.4951.41 | 101.0.4951.41 | |
| chrome | >= unspecified < 101.0.4951.41 | 101.0.4951.41 | |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-949f-px3r-jjxq: Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101
ghsa_unreviewed·2022-07-27
CVE-2022-1489 [HIGH] CWE-787 GHSA-949f-px3r-jjxq: Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101
Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
OSV
CVE-2022-1489: Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101
osv·2022-07-26·CVSS 8.8
CVE-2022-1489 [HIGH] CVE-2022-1489: Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101
Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
Red Hat
kernel: ipv6: Fix signed integer overflow in __ip6_append_data
vendor_redhat·2025-02-26·CVSS 5.5
CVE-2022-49728 [MEDIUM] CWE-190 kernel: ipv6: Fix signed integer overflow in __ip6_append_data
kernel: ipv6: Fix signed integer overflow in __ip6_append_data
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix signed integer overflow in __ip6_append_data
Resurrect ubsan overflow checks and ubsan report this warning,
fix it by change the variable [length] type to size_t.
UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19
2147479552 + 8567 cannot be represented in type 'int'
CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x214/0x230
show_stack+0x30/0x78
dump_stack_lvl+0xf8/0x118
dump_stack+0x18/0x30
ubsan_epilogue+0x18/0x60
handle_overflow+0xd0/0xf0
__ubsan_handle_add_overflow+0x34/0x44
__ip6_append_data.isra.48+0x1598/0x1688
ip6_append_data+0x128/0x260
udpv6_sendmsg+0x680/0xdd0
i
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2022-1489
vendor_chrome·2022-05-31·CVSS 8.8
CVE-2022-1489 [MEDIUM] Long Term Support Channel Update for ChromeOS: CVE-2022-1489
Long Term Support Channel Update for ChromeOS
CVE-2022-1489: Out of bounds memory access in UI Shelf. Giuliana Pritchard Google Chrome OS
Severity: medium
Debian
CVE-2022-1489: chromium - Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros pr...
vendor_debian·2022·CVSS 8.8
CVE-2022-1489 [HIGH] CVE-2022-1489: chromium - Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros pr...
Out of bounds memory access in UI Shelf in Google Chrome on Chrome OS, Lacros prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
Scope: local
bookworm: resolved (fixed in 101.0.4951.41-1)
bullseye: resolved (fixed in 101.0.4951.41-1~deb11u1)
forky: resolved (fixed in 101.0.4951.41-1)
sid: resolved (fixed in 101.0.4951.41-1)
trixie: resolved (fixed in 101.0.4951.41-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2022-49985 kernel: bpf: Don't use tnum_range on array range checking for poke descriptors
bugzilla·2025-06-18·CVSS 7.1
CVE-2022-49985 [HIGH] CVE-2022-49985 kernel: bpf: Don't use tnum_range on array range checking for poke descriptors
CVE-2022-49985 kernel: bpf: Don't use tnum_range on array range checking for poke descriptors
In the Linux kernel, the following vulnerability has been resolved:
bpf: Don't use tnum_range on array range checking for poke descriptors
Hsin-Wei reported a KASAN splat triggered by their BPF runtime fuzzer which
is based on a customized syzkaller:
BUG: KASAN: slab-out-of-bounds in bpf_int_jit_compile+0x1257/0x13f0
Read of size 8 at addr ffff888004e90b58 by task syz-executor.0/1489
CPU: 1 PID: 1489 Comm: syz-executor.0 Not tainted 5.19.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
dump_stack_lvl+0x9c/0xc9
print_address_description.constprop.0+0x1f/0x1f0
? bpf_int_jit_compile+0x1257/0x13f0
kasan_report.cold+0xeb/0x197
? kvmalloc_nod
Bugzilla
CVE-2022-49728 kernel: ipv6: Fix signed integer overflow in __ip6_append_data
bugzilla·2025-02-26·CVSS 5.5
CVE-2022-49728 [MEDIUM] CVE-2022-49728 kernel: ipv6: Fix signed integer overflow in __ip6_append_data
CVE-2022-49728 kernel: ipv6: Fix signed integer overflow in __ip6_append_data
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix signed integer overflow in __ip6_append_data
Resurrect ubsan overflow checks and ubsan report this warning,
fix it by change the variable [length] type to size_t.
UBSAN: signed-integer-overflow in net/ipv6/ip6_output.c:1489:19
2147479552 + 8567 cannot be represented in type 'int'
CPU: 0 PID: 253 Comm: err Not tainted 5.16.0+ #1
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x214/0x230
show_stack+0x30/0x78
dump_stack_lvl+0xf8/0x118
dump_stack+0x18/0x30
ubsan_epilogue+0x18/0x60
handle_overflow+0xd0/0xf0
__ubsan_handle_add_overflow+0x34/0x44
__ip6_append_data.isra.48+0x1598/0x1688
ip6_append_data+0x128/0x260
udpv6_sen
https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.htmlhttps://crbug.com/1300561https://security.gentoo.org/glsa/202208-25https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.htmlhttps://crbug.com/1300561https://security.gentoo.org/glsa/202208-25
2022-07-26
Published