github - ghsa-gvp8-gmj5-m6g2

ghsa-gvp8-gmj5-m6g2

Vulnerability from github

Published

2025-09-15 15:31

Modified

2025-09-15 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

cpufreq: qcom: fix writes in read-only memory region

This commit fixes a kernel oops because of a write in some read-only memory:

[    9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8
..snip..
[    9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP
..snip..
[    9.269161] Call trace:
[    9.276271]  __memcpy+0x5c/0x230
[    9.278531]  snprintf+0x58/0x80
[    9.282002]  qcom_cpufreq_msm8939_name_version+0xb4/0x190
[    9.284869]  qcom_cpufreq_probe+0xc8/0x39c
..snip..

The following line defines a pointer that point to a char buffer stored in read-only memory:

char *pvs_name = "speedXX-pvsXX-vXX";

This pointer is meant to hold a template "speedXX-pvsXX-vXX" where the XX values get overridden by the qcom_cpufreq_krait_name_version function. Since the template is actually stored in read-only memory, when the function executes the following call we get an oops:

snprintf(*pvs_name, sizeof("speedXX-pvsXX-vXX"), "speed%d-pvs%d-v%d",
     speed, pvs, pvs_ver);

To fix this issue, we instead store the template name onto the stack by using the following syntax:

char pvs_name_buffer[] = "speedXX-pvsXX-vXX";

Because the pvs_name needs to be able to be assigned to NULL, the template buffer is stored in the pvs_name_buffer and not under the pvs_name variable.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2022-50239"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-09-15T14:15:34Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: qcom: fix writes in read-only memory region\n\nThis commit fixes a kernel oops because of a write in some read-only memory:\n\n\t[    9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8\n\t..snip..\n\t[    9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP\n\t..snip..\n\t[    9.269161] Call trace:\n\t[    9.276271]  __memcpy+0x5c/0x230\n\t[    9.278531]  snprintf+0x58/0x80\n\t[    9.282002]  qcom_cpufreq_msm8939_name_version+0xb4/0x190\n\t[    9.284869]  qcom_cpufreq_probe+0xc8/0x39c\n\t..snip..\n\nThe following line defines a pointer that point to a char buffer stored\nin read-only memory:\n\n\tchar *pvs_name = \"speedXX-pvsXX-vXX\";\n\nThis pointer is meant to hold a template \"speedXX-pvsXX-vXX\" where the\nXX values get overridden by the qcom_cpufreq_krait_name_version function. Since\nthe template is actually stored in read-only memory, when the function\nexecutes the following call we get an oops:\n\n\tsnprintf(*pvs_name, sizeof(\"speedXX-pvsXX-vXX\"), \"speed%d-pvs%d-v%d\",\n\t\t speed, pvs, pvs_ver);\n\nTo fix this issue, we instead store the template name onto the stack by\nusing the following syntax:\n\n\tchar pvs_name_buffer[] = \"speedXX-pvsXX-vXX\";\n\nBecause the `pvs_name` needs to be able to be assigned to NULL, the\ntemplate buffer is stored in the pvs_name_buffer and not under the\npvs_name variable.",
  "id": "GHSA-gvp8-gmj5-m6g2",
  "modified": "2025-09-15T15:31:21Z",
  "published": "2025-09-15T15:31:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-50239"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/01039fb8e90c9cb684430414bff70cea9eb168c5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/14d260f94ff89543597ffea13db8b277a810e08e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/794ded0bc461287a268bed21fea2eebb6e5d232c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b74ee4e301ca01e431e240c046173332966e2431"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2022-50239 (GCVE-0-2022-50239)

Vulnerability from cvelistv5

Published

2025-09-15 14:01

Modified

2025-09-15 14:01

Severity ?

Summary

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom: fix writes in read-only memory region This commit fixes a kernel oops because of a write in some read-only memory: [ 9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8 ..snip.. [ 9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP ..snip.. [ 9.269161] Call trace: [ 9.276271] __memcpy+0x5c/0x230 [ 9.278531] snprintf+0x58/0x80 [ 9.282002] qcom_cpufreq_msm8939_name_version+0xb4/0x190 [ 9.284869] qcom_cpufreq_probe+0xc8/0x39c ..snip.. The following line defines a pointer that point to a char buffer stored in read-only memory: char *pvs_name = "speedXX-pvsXX-vXX"; This pointer is meant to hold a template "speedXX-pvsXX-vXX" where the XX values get overridden by the qcom_cpufreq_krait_name_version function. Since the template is actually stored in read-only memory, when the function executes the following call we get an oops: snprintf(*pvs_name, sizeof("speedXX-pvsXX-vXX"), "speed%d-pvs%d-v%d", speed, pvs, pvs_ver); To fix this issue, we instead store the template name onto the stack by using the following syntax: char pvs_name_buffer[] = "speedXX-pvsXX-vXX"; Because the `pvs_name` needs to be able to be assigned to NULL, the template buffer is stored in the pvs_name_buffer and not under the pvs_name variable.

References

▼	URL	Tags
	https://git.kernel.org/stable/c/794ded0bc461287a268bed21fea2eebb6e5d232c
	https://git.kernel.org/stable/c/14d260f94ff89543597ffea13db8b277a810e08e
	https://git.kernel.org/stable/c/b74ee4e301ca01e431e240c046173332966e2431
	https://git.kernel.org/stable/c/01039fb8e90c9cb684430414bff70cea9eb168c5

Impacted products

Vendor

Product

Version

▼

Linux

Version: a8811ec764f95a04ba82f6f457e28c5e9e36e36b
Version: a8811ec764f95a04ba82f6f457e28c5e9e36e36b
Version: a8811ec764f95a04ba82f6f457e28c5e9e36e36b
Version: a8811ec764f95a04ba82f6f457e28c5e9e36e36b

Linux

Version: 5.7

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/cpufreq/qcom-cpufreq-nvmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "794ded0bc461287a268bed21fea2eebb6e5d232c",
              "status": "affected",
              "version": "a8811ec764f95a04ba82f6f457e28c5e9e36e36b",
              "versionType": "git"
            },
            {
              "lessThan": "14d260f94ff89543597ffea13db8b277a810e08e",
              "status": "affected",
              "version": "a8811ec764f95a04ba82f6f457e28c5e9e36e36b",
              "versionType": "git"
            },
            {
              "lessThan": "b74ee4e301ca01e431e240c046173332966e2431",
              "status": "affected",
              "version": "a8811ec764f95a04ba82f6f457e28c5e9e36e36b",
              "versionType": "git"
            },
            {
              "lessThan": "01039fb8e90c9cb684430414bff70cea9eb168c5",
              "status": "affected",
              "version": "a8811ec764f95a04ba82f6f457e28c5e9e36e36b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/cpufreq/qcom-cpufreq-nvmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.76",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.0.*",
              "status": "unaffected",
              "version": "6.0.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.152",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.76",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.6",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncpufreq: qcom: fix writes in read-only memory region\n\nThis commit fixes a kernel oops because of a write in some read-only memory:\n\n\t[    9.068287] Unable to handle kernel write to read-only memory at virtual address ffff800009240ad8\n\t..snip..\n\t[    9.138790] Internal error: Oops: 9600004f [#1] PREEMPT SMP\n\t..snip..\n\t[    9.269161] Call trace:\n\t[    9.276271]  __memcpy+0x5c/0x230\n\t[    9.278531]  snprintf+0x58/0x80\n\t[    9.282002]  qcom_cpufreq_msm8939_name_version+0xb4/0x190\n\t[    9.284869]  qcom_cpufreq_probe+0xc8/0x39c\n\t..snip..\n\nThe following line defines a pointer that point to a char buffer stored\nin read-only memory:\n\n\tchar *pvs_name = \"speedXX-pvsXX-vXX\";\n\nThis pointer is meant to hold a template \"speedXX-pvsXX-vXX\" where the\nXX values get overridden by the qcom_cpufreq_krait_name_version function. Since\nthe template is actually stored in read-only memory, when the function\nexecutes the following call we get an oops:\n\n\tsnprintf(*pvs_name, sizeof(\"speedXX-pvsXX-vXX\"), \"speed%d-pvs%d-v%d\",\n\t\t speed, pvs, pvs_ver);\n\nTo fix this issue, we instead store the template name onto the stack by\nusing the following syntax:\n\n\tchar pvs_name_buffer[] = \"speedXX-pvsXX-vXX\";\n\nBecause the `pvs_name` needs to be able to be assigned to NULL, the\ntemplate buffer is stored in the pvs_name_buffer and not under the\npvs_name variable."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T14:01:43.916Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/794ded0bc461287a268bed21fea2eebb6e5d232c"
        },
        {
          "url": "https://git.kernel.org/stable/c/14d260f94ff89543597ffea13db8b277a810e08e"
        },
        {
          "url": "https://git.kernel.org/stable/c/b74ee4e301ca01e431e240c046173332966e2431"
        },
        {
          "url": "https://git.kernel.org/stable/c/01039fb8e90c9cb684430414bff70cea9eb168c5"
        }
      ],
      "title": "cpufreq: qcom: fix writes in read-only memory region",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-50239",
    "datePublished": "2025-09-15T14:01:43.916Z",
    "dateReserved": "2025-09-15T13:58:00.971Z",
    "dateUpdated": "2025-09-15T14:01:43.916Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted