CVE-2022-49885

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init()

Change num_ghes from int to unsigned int, preventing an overflow

and causing subsequent vmalloc() to fail.

The overflow happens in ghes_estatus_pool_init() when calculating

len during execution of the statement below as both multiplication

operands here are signed int:

len += (num_ghes * GHES_ESOURCE_PREALLOC_MAX_SIZE);

The following call trace is observed because of this bug:

[ 9.317108] swapper/0: vmalloc error: size 18446744071562596352, exceeds total pages, mode:0xcc0(GFP_KERNEL), nodemask=(null),cpuset=/,mems_allowed=0-1

[ 9.317131] Call Trace:

[ 9.317134] <TASK>

[ 9.317137] dump_stack_lvl+0x49/0x5f

[ 9.317145] dump_stack+0x10/0x12

[ 9.317146] warn_alloc.cold+0x7b/0xdf

[ 9.317150] ? __device_attach+0x16a/0x1b0

[ 9.317155] __vmalloc_node_range+0x702/0x740

[ 9.317160] ? device_add+0x17f/0x920

[ 9.317164] ? dev_se

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References