CVE-2022-49163 (GCVE-0-2022-49163)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:55 – Updated: 2026-08-05 08:54
VLAI
Title
media: imx-jpeg: fix a bug of accessing array out of bounds
Summary
In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: fix a bug of accessing array out of bounds When error occurs in parsing jpeg, the slot isn't acquired yet, it may be the default value MXC_MAX_SLOTS. If the driver access the slot using the incorrect slot number, it will access array out of bounds. The result is the driver will change num_domains, which follows slot_data in struct mxc_jpeg_dev. Then the driver won't detach the pm domain at rmmod, which will lead to kernel panic when trying to insmod again.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2db16c6ed72ce644d5639b3ed15e5817442db4ba , < 02f9f97d54ffc85b50ad77f5b1f3c8f69cd17747 (git)
Affected: 2db16c6ed72ce644d5639b3ed15e5817442db4ba , < 20c8b90430c5d6c4a3936eaa7c35aac670581487 (git)
Affected: 2db16c6ed72ce644d5639b3ed15e5817442db4ba , < e209e6db2e527db6a93b14c2deedf969caca78fc (git)
Affected: 2db16c6ed72ce644d5639b3ed15e5817442db4ba , < 97558d170a1236280407e8d29a7d095d2c2ed554 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.13
Unaffected: 0 , < 5.13 (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/imx-jpeg/mxc-jpeg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "02f9f97d54ffc85b50ad77f5b1f3c8f69cd17747",
              "status": "affected",
              "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
              "versionType": "git"
            },
            {
              "lessThan": "20c8b90430c5d6c4a3936eaa7c35aac670581487",
              "status": "affected",
              "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
              "versionType": "git"
            },
            {
              "lessThan": "e209e6db2e527db6a93b14c2deedf969caca78fc",
              "status": "affected",
              "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
              "versionType": "git"
            },
            {
              "lessThan": "97558d170a1236280407e8d29a7d095d2c2ed554",
              "status": "affected",
              "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/media/platform/imx-jpeg/mxc-jpeg.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imx-jpeg: fix a bug of accessing array out of bounds\n\nWhen error occurs in parsing jpeg, the slot isn\u0027t acquired yet, it may\nbe the default value MXC_MAX_SLOTS.\nIf the driver access the slot using the incorrect slot number, it will\naccess array out of bounds.\nThe result is the driver will change num_domains, which follows\nslot_data in struct mxc_jpeg_dev.\nThen the driver won\u0027t detach the pm domain at rmmod, which will lead to\nkernel panic when trying to insmod again."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is in the i.MX8 V4L2 mem2mem JPEG codec (mxc_jpeg_device_run), reached only via local open/ioctl/streaming on /dev/video*. It is not reachable from network packets or physical bus traffic.\nAC:L - An attacker who can open the decoder can reliably set jpeg_parse_error (malformed JPEG in buf_queue, or capture/output plane mismatch) while ctx-\u003eslot is still MXC_MAX_SLOTS, causing a deterministic out-of-bounds write with no race or uncontrollable condition.\nPR:L - The driver has no capability checks; V4L2 nodes are group video with uaccess, and on typical i.MX/Android deployments unprivileged apps can use the JPEG codec. Real root is not required.\nUI:N - The attacker opens the device and queues buffers themselves; no separate victim action is needed to hit the parse-error path.\nS:U - The OOB write corrupts fields in the same kernel mxc_jpeg_dev object and does not cross a VM, IOMMU, or other security-authority boundary.\nC:N - The bug is a write-only store of a fixed false/0 into the byte overlapping num_domains; there is no out-of-bounds read or other disclosure primitive.\nI:H - Accessing slot_data[MXC_MAX_SLOTS].used is an out-of-bounds write into adjacent kernel memory (num_domains). Per kernel CVSS guidance, out-of-bounds writes are scored High.\nA:H - Corrupting num_domains skips PM-domain detach on rmmod and the fix commit documents a resulting kernel panic on re-insmod; kernel crash/panic is High availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:10.174Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/02f9f97d54ffc85b50ad77f5b1f3c8f69cd17747"
        },
        {
          "url": "https://git.kernel.org/stable/c/20c8b90430c5d6c4a3936eaa7c35aac670581487"
        },
        {
          "url": "https://git.kernel.org/stable/c/e209e6db2e527db6a93b14c2deedf969caca78fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/97558d170a1236280407e8d29a7d095d2c2ed554"
        }
      ],
      "title": "media: imx-jpeg: fix a bug of accessing array out of bounds",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49163",
    "datePublished": "2025-02-26T01:55:24.043Z",
    "dateReserved": "2025-02-26T01:49:39.277Z",
    "dateUpdated": "2026-08-05T08:54:10.174Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49163",
      "date": "2026-09-24",
      "epss": "0.00275",
      "percentile": "0.17728"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/imx-jpeg/mxc-jpeg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "02f9f97d54ffc85b50ad77f5b1f3c8f69cd17747",
                    "status": "affected",
                    "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "20c8b90430c5d6c4a3936eaa7c35aac670581487",
                    "status": "affected",
                    "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e209e6db2e527db6a93b14c2deedf969caca78fc",
                    "status": "affected",
                    "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "97558d170a1236280407e8d29a7d095d2c2ed554",
                    "status": "affected",
                    "version": "2db16c6ed72ce644d5639b3ed15e5817442db4ba",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/media/platform/imx-jpeg/mxc-jpeg.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.13"
                  },
                  {
                    "lessThan": "5.13",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.33",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.16.*",
                    "status": "unaffected",
                    "version": "5.16.19",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.17.*",
                    "status": "unaffected",
                    "version": "5.17.2",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "5.18",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "3635E21D-6C8E-41E4-BF98-89A503BAF23D",
                    "versionEndExcluding": "5.15.33",
                    "versionStartIncluding": "5.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "20C43679-0439-405A-B97F-685BEE50613B",
                    "versionEndExcluding": "5.16.19",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "210C679C-CF84-44A3-8939-E629C87E54BF",
                    "versionEndExcluding": "5.17.2",
                    "versionStartIncluding": "5.17",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmedia: imx-jpeg: fix a bug of accessing array out of bounds\n\nWhen error occurs in parsing jpeg, the slot isn\u0027t acquired yet, it may\nbe the default value MXC_MAX_SLOTS.\nIf the driver access the slot using the incorrect slot number, it will\naccess array out of bounds.\nThe result is the driver will change num_domains, which follows\nslot_data in struct mxc_jpeg_dev.\nThen the driver won\u0027t detach the pm domain at rmmod, which will lead to\nkernel panic when trying to insmod again."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: media: imx-jpeg: corrige un error de acceso a la matriz fuera de los l\u00edmites Cuando ocurre un error al analizar jpeg, la ranura a\u00fan no se adquiere, puede ser el valor predeterminado MXC_MAX_SLOTS. Si el controlador accede a la ranura usando el n\u00famero de ranura incorrecto, acceder\u00e1 a la matriz fuera de los l\u00edmites. El resultado es que el controlador cambiar\u00e1 num_domains, que sigue a slot_data en struct mxc_jpeg_dev. Luego, el controlador no separar\u00e1 el dominio pm en rmmod, lo que provocar\u00e1 un p\u00e1nico del kernel al intentar insmod nuevamente."
          }
        ],
        "id": "CVE-2022-49163",
        "lastModified": "2026-08-04T10:17:37.180",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2025-02-26T07:00:53.473",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/02f9f97d54ffc85b50ad77f5b1f3c8f69cd17747"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/20c8b90430c5d6c4a3936eaa7c35aac670581487"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/97558d170a1236280407e8d29a7d095d2c2ed554"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/e209e6db2e527db6a93b14c2deedf969caca78fc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-125"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:22:19+00:00",
      "cve": "CVE-2022-49163",
      "id": "CVE-2022-49163",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: media: imx-jpeg: fix a bug of accessing array out of bounds",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49163.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-03T00:39:37Z",
      "cve": "CVE-2022-49163",
      "id": "CVE-2022-49163",
      "initial_release_date": "2025-02-27T03:11:18Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "401",
      "product_status:recommended": "223",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49163",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49163.json",
      "version": "46"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.