CVE-2022-48627: vt: fix memory overlapping when deleting chars in the buffer
In the Linux kernel, the following vulnerability has been resolved:
vt: fix memory overlapping when deleting chars in the buffer
A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scrmemcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buffer overlaps with the source buffer. The line buffer is not always broken, because the memcpy utilizes the hardware acceleration, whose result is not deterministic.
Fix this problem by using replacing the scrmemcpyw with scrmemmovew.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
vt: fix memory overlapping when deleting chars in the buffer
The Linux kernel CVE team has assigned CVE-2022-48627 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024030252-CVE-2022-48627-c7bf@gregkh/T/#u
— Red Hat
Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by a memory overlapping flaw when deleting chars in the buffer. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48627?
CVE-2022-48627 has been classified as a medium severity vulnerability due to potential data corruption risks.
How do I fix CVE-2022-48627?
To fix CVE-2022-48627, upgrade the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, or 6.12.12-1.
What systems are affected by CVE-2022-48627?
CVE-2022-48627 affects specific versions of the Linux kernel in Debian environments.
What is the nature of the issue in CVE-2022-48627?
CVE-2022-48627 involves a memory overlapping issue that can lead to data corruption when deleting characters in a buffer.
Is there a workaround for CVE-2022-48627?
There are no recommended workarounds for CVE-2022-48627; updating to a secure kernel version is the best course of action.