Riskcovery

CVE-2022-49643

ima: Fix a potential integer overflow in ima_appraise_measurement

State
Published
Severity
7.1 High
Published
Feb 26, 2025
Updated
Aug 5, 2026
Reserved
Feb 26, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ima: Fix a potential integer overflow in ima_appraise_measurement

When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be negative, which may cause the integer overflow problem.

Scores

CVSSScoreVectorSource
3.17.1 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HLinux
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HCISA-ADP

Weaknesses

  • CWE-190 Integer Overflow or Wraparound

Affected Products

ProductVersions
LinuxLinux
  • 39b07096364a42c516415d5f841069e885234e61 to before 388f3df7c3c8b7f2a32b9ae0a9b2f9f6ad3b1b77Affected
  • 39b07096364a42c516415d5f841069e885234e61 to before 831e190175f10652be93b08436cc7bf2e62e4bb6Affected
  • 39b07096364a42c516415d5f841069e885234e61 to before c8d5d81940938b5f6c0f495ca9538e7740416f30Affected
  • 39b07096364a42c516415d5f841069e885234e61 to before 640cea4c2839a821adfbb703b590a5928abe9286Affected
  • 39b07096364a42c516415d5f841069e885234e61 to before d2ee2cfc4aa85ff6a2a3b198a3a524ec54e3d999Affected
LinuxLinux
  • 5.4Affected
  • before 5.4Not affected
  • 5.4.207 through 5.4.*Not affected
  • 5.10.132 through 5.10.*Not affected
  • 5.15.56 through 5.15.*Not affected
  • 5.18.13 through 5.18.*Not affected
  • 5.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.