CVE-2022-48655
published 2024-04-28CVE-2022-48655: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.74%
50.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Harden accesses to the reset domains
Accessing reset domains descriptors by the index upon the SCMI drivers
requests through the SCMI reset operations interface can potentially
lead to out-of-bound violations if the SCMI driver misbehave.
Add an internal consistency check before any such domains descriptors
accesses.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.0.2-1 (bookworm) | linux 6.0.2-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5 < 7184491fc515f391afba23d0e9b690caaea72daf | 7184491fc515f391afba23d0e9b690caaea72daf |
| linux | linux | >= 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5 < f2277d9e2a0d092c13bae7ee82d75432bb8b5108 | f2277d9e2a0d092c13bae7ee82d75432bb8b5108 |
| linux | linux | >= 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5 < 1f08a1b26cfc53b7715abc46857c6023bb1b87de | 1f08a1b26cfc53b7715abc46857c6023bb1b87de |
| linux | linux | >= 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5 < 8e65edf0d37698f7a6cb174608d3ec7976baf49e | 8e65edf0d37698f7a6cb174608d3ec7976baf49e |
| linux | linux | >= 95a15d80aa0de938299acfcbc6aa6f2b16f5d7e5 < e9076ffbcaed5da6c182b144ef9f6e24554af268 | e9076ffbcaed5da6c182b144ef9f6e24554af268 |
| linux | linux_kernel | < 5.19.12 | 5.19.12 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.218-1 | 5.10.218-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 6.0.2-1 | 6.0.2-1 |
| linux | linux_kernel | >= 0 < 5.4.0-190.210 | 5.4.0-190.210 |
| linux | linux_kernel | >= 5.11 < 5.15.71 | 5.15.71 |
| linux | linux_kernel | >= 5.4 < 5.4.277 | 5.4.277 |
| linux | linux_kernel | >= 5.5 < 5.10.218 | 5.10.218 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-raspi-5.4 vulnerabilities
osv·2024-08-22·CVSS 7.8
[HIGH] linux-raspi-5.4 vulnerabilities
linux-raspi-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- M68K architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Accessibility subsystem;
- Character device driver;
- Clock framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buffer Sharing and Synchronization framework;
- FireWire subsystem;
- ARM SCMI message protocol;
- GPU drivers;
- HW tracing;
- InfiniBand drivers;
- Macintosh device drivers;
- Multiple devices driver;
- Media drivers;
- Network drivers;
- Pin controllers subsystem;
- S/390 drivers;
- SCSI drivers;
- SoundWire subsystem;
- Greybus lights st
OSV
linux-oracle, linux-oracle-5.4 vulnerabilities
osv·2024-08-09·CVSS 7.8
[HIGH] linux-oracle, linux-oracle-5.4 vulnerabilities
linux-oracle, linux-oracle-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- M68K architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Accessibility subsystem;
- Character device driver;
- Clock framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buffer Sharing and Synchronization framework;
- FireWire subsystem;
- ARM SCMI message protocol;
- GPU drivers;
- HW tracing;
- InfiniBand drivers;
- Macintosh device drivers;
- Multiple devices driver;
- Media drivers;
- Network drivers;
- Pin controllers subsystem;
- S/390 drivers;
- SCSI drivers;
- SoundWire subsystem;
- Gr
OSV
linux-aws, linux-aws-5.4 vulnerabilities
osv·2024-07-30·CVSS 7.8
CVE-2022-48655 [HIGH] linux-aws, linux-aws-5.4 vulnerabilities
linux-aws, linux-aws-5.4 vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM SCMI message protocol;
- InfiniBand drivers;
- TTY drivers;
- TLS protocol;
(CVE-2022-48655, CVE-2024-36016, CVE-2024-26584, CVE-2021-47131,
CVE-2024-26907, CVE-2024-26585, CVE-2024-26583)
OSV
linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp vulnerabili
osv·2024-07-29·CVSS 7.8
CVE-2024-26584 [HIGH] linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp vulnerabili
linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp, linux-gcp-5.4, linux-gkeop, linux-hwe-5.4, linux-ibm, linux-ibm-5.4, linux-iot, linux-kvm, linux-raspi, linux-xilinx-zynqmp vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM SCMI message protocol;
- InfiniBand drivers;
- TTY drivers;
- TLS protocol;
(CVE-2024-26584, CVE-2024-36016, CVE-2024-26585, CVE-2021-47131,
CVE-2024-26907, CVE-2022-48655, CVE-2024-26583)
OSV
CVE-2022-48655: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains d
osv·2024-04-28·CVSS 7.8
CVE-2022-48655 [HIGH] CVE-2022-48655: In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains d
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses.
GHSA
GHSA-x6r5-8xcj-pv7f: In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Harden accesses to the reset domains
Accessing reset domains
ghsa_unreviewed·2024-04-28
CVE-2022-48655 [HIGH] CWE-119 GHSA-x6r5-8xcj-pv7f: In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Harden accesses to the reset domains
Accessing reset domains
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Harden accesses to the reset domains
Accessing reset domains descriptors by the index upon the SCMI drivers
requests through the SCMI reset operations interface can potentially
lead to out-of-bound violations if the SCMI driver misbehave.
Add an internal consistency check before any such domains descriptors
accesses.
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2024-08-22·CVSS 7.8
CVE-2024-38560 [HIGH] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- M68K architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Accessibility subsystem;
- Character device driver;
- Clock framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buffer Sharing and Synchronization framework;
- FireWire subsystem;
- ARM SCMI message protocol;
- GPU drivers;
- HW tracing;
- InfiniBand drivers;
- Macintosh device drivers;
- Multiple devices driver;
- Media drivers;
- Network drivers;
- Pin controllers s
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2024-08-09·CVSS 5.5
CVE-2024-38587 [MEDIUM] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- M68K architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Accessibility subsystem;
- Character device driver;
- Clock framework and drivers;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buffer Sharing and Synchronization framework;
- FireWire subsystem;
- ARM SCMI message protocol;
- GPU drivers;
- HW tracing;
- InfiniBand drivers;
- Macintosh device drivers;
- Multiple devices driver;
- Media drivers;
- Network drivers;
- Pin controllers subsyst
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-30·CVSS 7.8
CVE-2024-26907 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM SCMI message protocol;
- InfiniBand drivers;
- TTY drivers;
- TLS protocol;
(CVE-2022-48655, CVE-2024-36016, CVE-2024-26584, CVE-2021-47131,
CVE-2024-26907, CVE-2024-26585, CVE-2024-26583)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unl
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2024-07-29·CVSS 7.8
CVE-2024-26583 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM SCMI message protocol;
- InfiniBand drivers;
- TTY drivers;
- TLS protocol;
(CVE-2024-26584, CVE-2024-36016, CVE-2024-26585, CVE-2021-47131,
CVE-2024-26907, CVE-2022-48655, CVE-2024-26583)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
Unl
Red Hat
kernel: firmware: arm_scmi: Harden accesses to the reset domains
vendor_redhat·2024-04-28·CVSS 7.8
CVE-2022-48655 [HIGH] CWE-119 kernel: firmware: arm_scmi: Harden accesses to the reset domains
kernel: firmware: arm_scmi: Harden accesses to the reset domains
In the Linux kernel, the following vulnerability has been resolved:
firmware: arm_scmi: Harden accesses to the reset domains
Accessing reset domains descriptors by the index upon the SCMI drivers
requests through the SCMI reset operations interface can potentially
lead to out-of-bound violations if the SCMI driver misbehave.
Add an internal consistency check before any such domains descriptors
accesses.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel
Debian
CVE-2022-48655: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a...
vendor_debian·2022·CVSS 7.8
CVE-2022-48655 [HIGH] CVE-2022-48655: linux - In the Linux kernel, the following vulnerability has been resolved: firmware: a...
In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Harden accesses to the reset domains Accessing reset domains descriptors by the index upon the SCMI drivers requests through the SCMI reset operations interface can potentially lead to out-of-bound violations if the SCMI driver misbehave. Add an internal consistency check before any such domains descriptors accesses.
Scope: local
bookworm: resolved (fixed in 6.0.2-1)
bullseye: resolved (fixed in 5.10.218-1)
forky: resolved (fixed in 6.0.2-1)
sid: resolved (fixed in 6.0.2-1)
trixie: resolved (fixed in 6.0.2-1)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1f08a1b26cfc53b7715abc46857c6023bb1b87dehttps://git.kernel.org/stable/c/7184491fc515f391afba23d0e9b690caaea72dafhttps://git.kernel.org/stable/c/8e65edf0d37698f7a6cb174608d3ec7976baf49ehttps://git.kernel.org/stable/c/e9076ffbcaed5da6c182b144ef9f6e24554af268https://git.kernel.org/stable/c/f2277d9e2a0d092c13bae7ee82d75432bb8b5108https://git.kernel.org/stable/c/1f08a1b26cfc53b7715abc46857c6023bb1b87dehttps://git.kernel.org/stable/c/7184491fc515f391afba23d0e9b690caaea72dafhttps://git.kernel.org/stable/c/8e65edf0d37698f7a6cb174608d3ec7976baf49ehttps://git.kernel.org/stable/c/e9076ffbcaed5da6c182b144ef9f6e24554af268https://git.kernel.org/stable/c/f2277d9e2a0d092c13bae7ee82d75432bb8b5108https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlhttps://security.netapp.com/advisory/ntap-20240912-0008/
2024-04-28
Published