CVE-2022-49267

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49267
In the Linux kernel, the following vulnerability has been resolved: mmc: core: use sysfs_emit() instead of sprintf() sprintf() (still used in the MMC core for the sysfs output) is vulnerable to the buffer overflow. Use the new-fangled sysfs_emit() instead. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/659ca56b5415c7a1d05e185c36fad80ba165d063 Patch
https://git.kernel.org/stable/c/c4ab65738ab3e21fe519ee46b2051222bc8e32ef Patch
https://git.kernel.org/stable/c/f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

21 Oct 2025, 11:49

Type Values Removed Values Added
Summary
  • (es) En el núcleo de Linux, se ha resuelto la siguiente vulnerabilidad: mmc: core: use sysfs_emit() en lugar de sprintf() sprintf() (que todavía se usa en el núcleo de MMC para la salida de sysfs) es vulnerable al desbordamiento del búfer. Use el nuevo sysfs_emit() en su lugar. Encontrado por Linux Verification Center (linuxtesting.org) con la herramienta de análisis estático SVACE.
References () https://git.kernel.org/stable/c/659ca56b5415c7a1d05e185c36fad80ba165d063 - () https://git.kernel.org/stable/c/659ca56b5415c7a1d05e185c36fad80ba165d063 - Patch
References () https://git.kernel.org/stable/c/c4ab65738ab3e21fe519ee46b2051222bc8e32ef - () https://git.kernel.org/stable/c/c4ab65738ab3e21fe519ee46b2051222bc8e32ef - Patch
References () https://git.kernel.org/stable/c/f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11 - () https://git.kernel.org/stable/c/f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11 - Patch
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CWE CWE-120

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-10-21 11:49

NVD link : CVE-2022-49267

Mitre link : CVE-2022-49267

CVE.ORG link : CVE-2022-49267

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')