GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49260 (GCVE-0-2022-49260)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:56 – Updated: 2026-08-05 08:54
VLAI
Title
crypto: hisilicon/sec - fix the aead software fallback for engine
Summary
In the Linux kernel, the following vulnerability has been resolved: crypto: hisilicon/sec - fix the aead software fallback for engine Due to the subreq pointer misuse the private context memory. The aead soft crypto occasionally casues the OS panic as setting the 64K page. Here is fix it.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6c46a3297beae4ae2d22b26da5e091f058381c7c , < 40dba7c26e897c637e91312b35f664f1d4d0073c (git)
Affected: 6c46a3297beae4ae2d22b26da5e091f058381c7c , < ef7b10f3cac7810ddcfd976304fd125aca33d144 (git)
Affected: 6c46a3297beae4ae2d22b26da5e091f058381c7c , < 5c1149e2abe0b7489300736b8277b45b113de67f (git)
Affected: 6c46a3297beae4ae2d22b26da5e091f058381c7c , < 0a2a464f863187f97e96ebc6384c052cafd4a54c (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.33 , ≤ 5.15.* (semver)
Unaffected: 5.16.19 , ≤ 5.16.* (semver)
Unaffected: 5.17.2 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/hisilicon/sec2/sec_crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "40dba7c26e897c637e91312b35f664f1d4d0073c",
              "status": "affected",
              "version": "6c46a3297beae4ae2d22b26da5e091f058381c7c",
              "versionType": "git"
            },
            {
              "lessThan": "ef7b10f3cac7810ddcfd976304fd125aca33d144",
              "status": "affected",
              "version": "6c46a3297beae4ae2d22b26da5e091f058381c7c",
              "versionType": "git"
            },
            {
              "lessThan": "5c1149e2abe0b7489300736b8277b45b113de67f",
              "status": "affected",
              "version": "6c46a3297beae4ae2d22b26da5e091f058381c7c",
              "versionType": "git"
            },
            {
              "lessThan": "0a2a464f863187f97e96ebc6384c052cafd4a54c",
              "status": "affected",
              "version": "6c46a3297beae4ae2d22b26da5e091f058381c7c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/crypto/hisilicon/sec2/sec_crypto.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncrypto: hisilicon/sec - fix the aead software fallback for engine\n\nDue to the subreq pointer misuse the private context memory. The aead\nsoft crypto occasionally casues the OS panic as setting the 64K page.\nHere is fix it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On Kunpeng920 systems, hisi_sec GCM is selected as the rfc4106(gcm(aes)) child for IPsec ESP; inbound ESP decrypt with short elen (1\u20138) yields child cryptlen \u003c= authsize and hits the buggy soft-fallback path while processing attacker-controlled network packets.\nAC:L - The attacker fully controls ESP packet length (or AF_ALG cryptlen) and can reliably force the zero/short-length fallback; no race or external precondition beyond the presence of the affected accelerator is required.\nPR:N - ESP decrypt runs on SPI-matched packets before GCM tag authentication succeeds, so an unauthenticated remote peer can trigger the soft-fallback memory corruption; no local account or capability is required in the IPsec scenario.\nUI:N - Exploitation requires only attacker-sent ESP packets (or the attacker\u2019s own AF_ALG operations); no separate victim action is needed.\nS:U - Impact is kernel heap corruption and potential privilege escalation within the same host OS authority, not a VM/IOMMU/sandbox boundary escape.\nC:H - The bug treats undersized sec_req private context as a full aead_request plus software-GCM reqctx, causing a heap out-of-bounds write/type confusion that can be leveraged for arbitrary kernel memory disclosure.\nI:H - The same out-of-bounds write into adjacent heap objects provides a kernel memory corruption primitive usable for integrity compromise and control-flow hijacking.\nA:H - The commit documents OS panic on the affected 64K-page configuration, and heap corruption from the oversized soft-crypto request context can oops/panic the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:54:28.487Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/40dba7c26e897c637e91312b35f664f1d4d0073c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef7b10f3cac7810ddcfd976304fd125aca33d144"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c1149e2abe0b7489300736b8277b45b113de67f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a2a464f863187f97e96ebc6384c052cafd4a54c"
        }
      ],
      "title": "crypto: hisilicon/sec - fix the aead software fallback for engine",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49260",
    "datePublished": "2025-02-26T01:56:12.548Z",
    "dateReserved": "2025-02-26T01:49:39.296Z",
    "dateUpdated": "2026-08-05T08:54:28.487Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49260",
      "date": "2026-09-14",
      "epss": "0.00655",
      "percentile": "0.49442"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49260\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:01:02.967\",\"lastModified\":\"2026-08-04T10:17:41.363\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncrypto: hisilicon/sec - fix the aead software fallback for engine\\n\\nDue to the subreq pointer misuse the private context memory. The aead\\nsoft crypto occasionally casues the OS panic as setting the 64K page.\\nHere is fix it.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: crypto: hisilicon/sec - corrige el error de respaldo del software aead para el motor. Debido al mal uso del puntero subreq de la memoria de contexto privada, el cifrado suave aead a veces provoca un p\u00e1nico del sistema operativo al configurar la p\u00e1gina de 64K. Aqu\u00ed se soluciona.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/crypto/hisilicon/sec2/sec_crypto.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6c46a3297beae4ae2d22b26da5e091f058381c7c\",\"lessThan\":\"40dba7c26e897c637e91312b35f664f1d4d0073c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c46a3297beae4ae2d22b26da5e091f058381c7c\",\"lessThan\":\"ef7b10f3cac7810ddcfd976304fd125aca33d144\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c46a3297beae4ae2d22b26da5e091f058381c7c\",\"lessThan\":\"5c1149e2abe0b7489300736b8277b45b113de67f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6c46a3297beae4ae2d22b26da5e091f058381c7c\",\"lessThan\":\"0a2a464f863187f97e96ebc6384c052cafd4a54c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/crypto/hisilicon/sec2/sec_crypto.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.33\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.19\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.2\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.33\",\"matchCriteriaId\":\"FB1C7FD1-C89E-4955-B265-456A9F757302\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.19\",\"matchCriteriaId\":\"20C43679-0439-405A-B97F-685BEE50613B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.2\",\"matchCriteriaId\":\"210C679C-CF84-44A3-8939-E629C87E54BF\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0a2a464f863187f97e96ebc6384c052cafd4a54c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/40dba7c26e897c637e91312b35f664f1d4d0073c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5c1149e2abe0b7489300736b8277b45b113de67f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ef7b10f3cac7810ddcfd976304fd125aca33d144\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:39:25+00:00",
      "cve": "CVE-2022-49260",
      "id": "CVE-2022-49260",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: crypto: hisilicon/sec - fix the aead software fallback for engine",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49260.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-29T02:29:17Z",
      "cve": "CVE-2022-49260",
      "id": "CVE-2022-49260",
      "initial_release_date": "2025-02-27T03:09:49Z",
      "product_status:known_affected": "334",
      "product_status:known_not_affected": "401",
      "product_status:recommended": "223",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49260",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49260.json",
      "version": "47"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.