CVE-2022-49218 drm/dp: Fix OOB read when handling Post Cursor2 register
A local attacker can trigger an out-of-bounds read in the Linux kernel's DisplayPort driver, potentially exposing sensitive memory contents.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49218?
CVE-2022-49218 is a high-severity vulnerability in Linux kernel, published on 26 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drm/dp: Fix OOB read when handling Post Cursor2 register
The link_status array was not large enough to read the Adjust Request Post Cursor2 register, so remove the common helper function to avoid an OOB read, found with a -Warray-bounds build:
drivers/gpu/drm/drm_dp_helper.c: In function 'drm_dp_get_adjust_request_post_cursor': drivers/gpu/drm/drm_dp_helper.c:59:27: error: array subscript 10 is outside array bounds of 'const u8[6]' {aka 'const unsigned char[6]'} [-Werror=array-bounds] 59 | return link_status[r - DP_LANE0_1_STATUS]; | ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~ drivers/gpu/drm/drm_dp_helper.c:147:51: note: while referencing 'link_status' 147 | u8 drm_dp_get_adjust_request_post_cursor(const u8 link_status[DP_LINK_STATUS_SIZE], | ~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Replace the only user of the helper with an open-coded fetch and decode, similar to drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c.
Weakness: CWE-125
Which versions are affected by CVE-2022-49218?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49218?
Apply the vendor's patch.
Is CVE-2022-49218 being exploited?
There is no known exploitation of CVE-2022-49218 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-58832, DEBIAN-CVE-2022-49218, GHSA-5876-wpj2-hw48, ROOT-OS-DEBIAN-11-CVE-2022-49218, ROOT-OS-UBUNTU-2204-CVE-2022-49218, UBUNTU-CVE-2022-49218.