CVE-2022-49035

media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

State: Published
Severity: 5.5 Medium
Published: Jan 2, 2025
Updated: May 11, 2026
Reserved: Aug 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

media: s5p_cec: limit msg.len to CEC_MAX_MSG_SIZE

I expect that the hardware will have limited this to 16, but just in case it hasn't, check for this corner case.

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
LinuxLinux	1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 7ccb40f26cbefa1c6dfd3418bea54c9518cdbd8aAffected 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before fc0f76dd5f116fa9291327024dda392f8b4e849cAffected 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before a2728bf9b6c65e46468c763e3dab7e04839d4e11Affected 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 4a449430ecfb199b99ba58af63c467eb53500b39Affected 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 1609231f86760c1f6a429de7913dd795b9faa08cAffected 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before cbfa26936f318b16ccf9ca31b8e8b30c0dc087bdAffected 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 2654e785bd4aa2439cdffbe7dc1ea30a0eddbfe4Affected 1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 93f65ce036863893c164ca410938e0968964b26cAffected
LinuxLinux	4.8Affected before 4.8Not affected 4.9.333 through 4.9.Not affected 4.14.299 through 4.14.Not affected 4.19.265 through 4.19.Not affected 5.4.224 through 5.4.Not affected 5.10.154 through 5.10.Not affected 5.15.78 through 5.15.Not affected 6.0.8 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 7ccb40f26cbefa1c6dfd3418bea54c9518cdbd8aAffected
1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before fc0f76dd5f116fa9291327024dda392f8b4e849cAffected
1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before a2728bf9b6c65e46468c763e3dab7e04839d4e11Affected
1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 4a449430ecfb199b99ba58af63c467eb53500b39Affected
1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 1609231f86760c1f6a429de7913dd795b9faa08cAffected
1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before cbfa26936f318b16ccf9ca31b8e8b30c0dc087bdAffected
1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 2654e785bd4aa2439cdffbe7dc1ea30a0eddbfe4Affected
1bcbf6f4b6b050eaf8f1fb1adf5c4779a3623c5b to before 93f65ce036863893c164ca410938e0968964b26cAffected

LinuxLinux

4.8Affected
before 4.8Not affected
4.9.333 through 4.9.*Not affected
4.14.299 through 4.14.*Not affected
4.19.265 through 4.19.*Not affected
5.4.224 through 5.4.*Not affected
5.10.154 through 5.10.*Not affected
5.15.78 through 5.15.*Not affected
6.0.8 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.