CVE-2022-48627

vt: fix memory overlapping when deleting chars in the buffer

State
Published
Severity
5.5 Medium
Published
Mar 2, 2024
Updated
May 11, 2026
Reserved
Feb 25, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

vt: fix memory overlapping when deleting chars in the buffer

A memory overlapping copy occurs when deleting a long line. This memory overlapping copy can cause data corruption when scr_memcpyw is optimized to memcpy because memcpy does not ensure its behavior if the destination buffer overlaps with the source buffer. The line buffer is not always broken, because the memcpy utilizes the hardware acceleration, whose result is not deterministic.

Fix this problem by using replacing the scr_memcpyw with scr_memmovew.

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c to before c8686c014b5e872ba7e334f33ca553f14446fc29Affected
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c to before 815be99d934e3292906536275f2b8d5131cdf52cAffected
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c to before bfee93c9a6c395f9aa62268f1cedf64999844926Affected
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c to before 57964a5710252bc82fe22d9fa98c180c58c20244Affected
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c to before 14d2cc21ca622310babf373e3a8f0b40acfe8265Affected
  • 81732c3b2fede049a692e58a7ceabb6d18ffb18c to before 39cdb68c64d84e71a4a717000b6e5de208ee60ccAffected
LinuxLinux
  • 3.7Affected
  • before 3.7Not affected
  • 4.19.312 through 4.19.*Not affected
  • 5.4.274 through 5.4.*Not affected
  • 5.10.132 through 5.10.*Not affected
  • 5.15.56 through 5.15.*Not affected
  • 5.18.13 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.