GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-49073 (GCVE-0-2022-49073)

Vulnerability from cvelistv5 – Published: 2025-02-26 01:54 – Updated: 2026-08-05 08:53
VLAI
Title
ata: sata_dwc_460ex: Fix crash due to OOB write
Summary
In the Linux kernel, the following vulnerability has been resolved: ata: sata_dwc_460ex: Fix crash due to OOB write the driver uses libata's "tag" values from in various arrays. Since the mentioned patch bumped the ATA_TAG_INTERNAL to 32, the value of the SATA_DWC_QCMD_MAX needs to account for that. Otherwise ATA_TAG_INTERNAL usage cause similar crashes like this as reported by Tice Rex on the OpenWrt Forum and reproduced (with symbols) here: | BUG: Kernel NULL pointer dereference at 0x00000000 | Faulting instruction address: 0xc03ed4b8 | Oops: Kernel access of bad area, sig: 11 [#1] | BE PAGE_SIZE=4K PowerPC 44x Platform | CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0 | NIP: c03ed4b8 LR: c03d27e8 CTR: c03ed36c | REGS: cfa59950 TRAP: 0300 Not tainted (5.4.163) | MSR: 00021000 <CE,ME> CR: 42000222 XER: 00000000 | DEAR: 00000000 ESR: 00000000 | GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...] | [..] | NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254 | LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc | Call Trace: | [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable) | [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc | [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524 | [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0 | [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204 | [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130 | [...] This is because sata_dwc_dma_xfer_complete() NULLs the dma_pending's next neighbour "chan" (a *dma_chan struct) in this '32' case right here (line ~735): > hsdevp->dma_pending[tag] = SATA_DWC_DMA_PENDING_NONE; Then the next time, a dma gets issued; dma_dwc_xfer_setup() passes the NULL'd hsdevp->chan to the dmaengine_slave_config() which then causes the crash. With this patch, SATA_DWC_QCMD_MAX is now set to ATA_MAX_QUEUE + 1. This avoids the OOB. But please note, there was a worthwhile discussion on what ATA_TAG_INTERNAL and ATA_MAX_QUEUE is. And why there should not be a "fake" 33 command-long queue size. Ideally, the dw driver should account for the ATA_TAG_INTERNAL. In Damien Le Moal's words: "... having looked at the driver, it is a bigger change than just faking a 33rd "tag" that is in fact not a command tag at all." BugLink: https://github.com/openwrt/openwrt/issues/9505
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 28361c403683c2b00d4f5e76045f3ccd299bf99d , < 596c7efd69aae94f4b0e91172b075eb197958b99 (git)
Affected: 28361c403683c2b00d4f5e76045f3ccd299bf99d , < 55e1465ba79562a191708a40eeae3f8082a209e3 (git)
Affected: 28361c403683c2b00d4f5e76045f3ccd299bf99d , < fc629224aa62f23849cae83717932985ac51232d (git)
Affected: 28361c403683c2b00d4f5e76045f3ccd299bf99d , < 8a05a6952ecd59aaa62cbdcdaf523ae2c8f436e8 (git)
Affected: 28361c403683c2b00d4f5e76045f3ccd299bf99d , < 234c0132f76f0676d175757f61b0025191a3d935 (git)
Affected: 28361c403683c2b00d4f5e76045f3ccd299bf99d , < 3a8751c0d4e24129e72dcec0139e99833b13904a (git)
Affected: 28361c403683c2b00d4f5e76045f3ccd299bf99d , < 7aa8104a554713b685db729e66511b93d989dd6a (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 4.19.238 , ≤ 4.19.* (semver)
Unaffected: 5.4.189 , ≤ 5.4.* (semver)
Unaffected: 5.10.111 , ≤ 5.10.* (semver)
Unaffected: 5.15.34 , ≤ 5.15.* (semver)
Unaffected: 5.16.20 , ≤ 5.16.* (semver)
Unaffected: 5.17.3 , ≤ 5.17.* (semver)
Unaffected: 5.18 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/sata_dwc_460ex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "596c7efd69aae94f4b0e91172b075eb197958b99",
              "status": "affected",
              "version": "28361c403683c2b00d4f5e76045f3ccd299bf99d",
              "versionType": "git"
            },
            {
              "lessThan": "55e1465ba79562a191708a40eeae3f8082a209e3",
              "status": "affected",
              "version": "28361c403683c2b00d4f5e76045f3ccd299bf99d",
              "versionType": "git"
            },
            {
              "lessThan": "fc629224aa62f23849cae83717932985ac51232d",
              "status": "affected",
              "version": "28361c403683c2b00d4f5e76045f3ccd299bf99d",
              "versionType": "git"
            },
            {
              "lessThan": "8a05a6952ecd59aaa62cbdcdaf523ae2c8f436e8",
              "status": "affected",
              "version": "28361c403683c2b00d4f5e76045f3ccd299bf99d",
              "versionType": "git"
            },
            {
              "lessThan": "234c0132f76f0676d175757f61b0025191a3d935",
              "status": "affected",
              "version": "28361c403683c2b00d4f5e76045f3ccd299bf99d",
              "versionType": "git"
            },
            {
              "lessThan": "3a8751c0d4e24129e72dcec0139e99833b13904a",
              "status": "affected",
              "version": "28361c403683c2b00d4f5e76045f3ccd299bf99d",
              "versionType": "git"
            },
            {
              "lessThan": "7aa8104a554713b685db729e66511b93d989dd6a",
              "status": "affected",
              "version": "28361c403683c2b00d4f5e76045f3ccd299bf99d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/ata/sata_dwc_460ex.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.3",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.111",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.34",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.20",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nata: sata_dwc_460ex: Fix crash due to OOB write\n\nthe driver uses libata\u0027s \"tag\" values from in various arrays.\nSince the mentioned patch bumped the ATA_TAG_INTERNAL to 32,\nthe value of the SATA_DWC_QCMD_MAX needs to account for that.\n\nOtherwise ATA_TAG_INTERNAL usage cause similar crashes like\nthis as reported by Tice Rex on the OpenWrt Forum and\nreproduced (with symbols) here:\n\n| BUG: Kernel NULL pointer dereference at 0x00000000\n| Faulting instruction address: 0xc03ed4b8\n| Oops: Kernel access of bad area, sig: 11 [#1]\n| BE PAGE_SIZE=4K PowerPC 44x Platform\n| CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0\n| NIP:  c03ed4b8 LR: c03d27e8 CTR: c03ed36c\n| REGS: cfa59950 TRAP: 0300   Not tainted  (5.4.163)\n| MSR:  00021000 \u003cCE,ME\u003e  CR: 42000222  XER: 00000000\n| DEAR: 00000000 ESR: 00000000\n| GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...]\n| [..]\n| NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254\n| LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc\n| Call Trace:\n| [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable)\n| [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc\n| [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524\n| [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0\n| [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204\n| [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130\n| [...]\n\nThis is because sata_dwc_dma_xfer_complete() NULLs the\ndma_pending\u0027s next neighbour \"chan\" (a *dma_chan struct) in\nthis \u002732\u0027 case right here (line ~735):\n\u003e hsdevp-\u003edma_pending[tag] = SATA_DWC_DMA_PENDING_NONE;\n\nThen the next time, a dma gets issued; dma_dwc_xfer_setup() passes\nthe NULL\u0027d hsdevp-\u003echan to the dmaengine_slave_config() which then\ncauses the crash.\n\nWith this patch, SATA_DWC_QCMD_MAX is now set to ATA_MAX_QUEUE + 1.\nThis avoids the OOB. But please note, there was a worthwhile discussion\non what ATA_TAG_INTERNAL and ATA_MAX_QUEUE is. And why there should not\nbe a \"fake\" 33 command-long queue size.\n\nIdeally, the dw driver should account for the ATA_TAG_INTERNAL.\nIn Damien Le Moal\u0027s words: \"... having looked at the driver, it\nis a bigger change than just faking a 33rd \"tag\" that is in fact\nnot a command tag at all.\"\n\nBugLink: https://github.com/openwrt/openwrt/issues/9505"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The OOB write is in the platform SATA host driver (sata_dwc_dma_xfer_complete / sata_dwc_qc_issue) on the local libata internal-command path (ata_exec_internal \u2192 READ LOG DMA / identify during EH or configure), not in network packet processing or a USB/PCIe hotplug descriptor parser.\nAC:L - Once an internal ATA DMA command runs with active_tag=ATA_TAG_INTERNAL (32), completion deterministically indexes dma_pending[32], corrupts chan, and the next DMA issue NULLs through dmaengine_slave_config; no attacker-uncontrollable race is required.\nPR:L - On the severe but realistic deployment (OpenWrt/NAS appliances with this SoC), an unprivileged local user who can perform I/O against SATA-backed block devices can induce SCSI/libata EH and revalidate (which issues the internal DMA log/identify commands), matching prior SATA HBA scoring; real init-namespace root is not required.\nUI:N - EH revalidate and internal READ LOG DMA run in kernel scsi_eh context without a separate victim mount, open, or confirmation step once the attacker\u2019s I/O or recovery conditions are present.\nS:U - Corruption and the resulting oops stay inside the host kernel\u2019s libata/sata_dwc authority; this is not a VM escape, IOMMU/DMA boundary bypass, or other cross-authority break.\nC:H - Completion paths OOB-read dma_pending[32]/cmd_issued[32] (adjacent chan / dma_pending bytes, including kernel pointer bits logged as pending=) and the subsequent OOB write is memory corruption that, per scoring guidance, is treated as enabling disclosure primitives.\nI:H - hsdevp-\u003edma_pending[tag]=SATA_DWC_DMA_PENDING_NONE with tag 32 is an explicit out-of-bounds write into the adjacent dma_chan *chan; out-of-bounds writes are Integrity High under kernel CVSS guidance.\nA:H - The bug produces a documented kernel NULL pointer dereference oops in sata_dwc_qc_issue (and boot-time reboot loops on affected NAS hardware), which is Availability High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:53:43.327Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/596c7efd69aae94f4b0e91172b075eb197958b99"
        },
        {
          "url": "https://git.kernel.org/stable/c/55e1465ba79562a191708a40eeae3f8082a209e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/fc629224aa62f23849cae83717932985ac51232d"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a05a6952ecd59aaa62cbdcdaf523ae2c8f436e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/234c0132f76f0676d175757f61b0025191a3d935"
        },
        {
          "url": "https://git.kernel.org/stable/c/3a8751c0d4e24129e72dcec0139e99833b13904a"
        },
        {
          "url": "https://git.kernel.org/stable/c/7aa8104a554713b685db729e66511b93d989dd6a"
        }
      ],
      "title": "ata: sata_dwc_460ex: Fix crash due to OOB write",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49073",
    "datePublished": "2025-02-26T01:54:37.804Z",
    "dateReserved": "2025-02-26T01:49:39.245Z",
    "dateUpdated": "2026-08-05T08:53:43.327Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49073",
      "date": "2026-09-17",
      "epss": "0.00271",
      "percentile": "0.19468"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49073\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-02-26T07:00:44.647\",\"lastModified\":\"2026-08-04T10:17:33.230\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nata: sata_dwc_460ex: Fix crash due to OOB write\\n\\nthe driver uses libata\u0027s \\\"tag\\\" values from in various arrays.\\nSince the mentioned patch bumped the ATA_TAG_INTERNAL to 32,\\nthe value of the SATA_DWC_QCMD_MAX needs to account for that.\\n\\nOtherwise ATA_TAG_INTERNAL usage cause similar crashes like\\nthis as reported by Tice Rex on the OpenWrt Forum and\\nreproduced (with symbols) here:\\n\\n| BUG: Kernel NULL pointer dereference at 0x00000000\\n| Faulting instruction address: 0xc03ed4b8\\n| Oops: Kernel access of bad area, sig: 11 [#1]\\n| BE PAGE_SIZE=4K PowerPC 44x Platform\\n| CPU: 0 PID: 362 Comm: scsi_eh_1 Not tainted 5.4.163 #0\\n| NIP:  c03ed4b8 LR: c03d27e8 CTR: c03ed36c\\n| REGS: cfa59950 TRAP: 0300   Not tainted  (5.4.163)\\n| MSR:  00021000 \u003cCE,ME\u003e  CR: 42000222  XER: 00000000\\n| DEAR: 00000000 ESR: 00000000\\n| GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...]\\n| [..]\\n| NIP [c03ed4b8] sata_dwc_qc_issue+0x14c/0x254\\n| LR [c03d27e8] ata_qc_issue+0x1c8/0x2dc\\n| Call Trace:\\n| [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (unreliable)\\n| [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc\\n| [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524\\n| [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0\\n| [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204\\n| [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130\\n| [...]\\n\\nThis is because sata_dwc_dma_xfer_complete() NULLs the\\ndma_pending\u0027s next neighbour \\\"chan\\\" (a *dma_chan struct) in\\nthis \u002732\u0027 case right here (line ~735):\\n\u003e hsdevp-\u003edma_pending[tag] = SATA_DWC_DMA_PENDING_NONE;\\n\\nThen the next time, a dma gets issued; dma_dwc_xfer_setup() passes\\nthe NULL\u0027d hsdevp-\u003echan to the dmaengine_slave_config() which then\\ncauses the crash.\\n\\nWith this patch, SATA_DWC_QCMD_MAX is now set to ATA_MAX_QUEUE + 1.\\nThis avoids the OOB. But please note, there was a worthwhile discussion\\non what ATA_TAG_INTERNAL and ATA_MAX_QUEUE is. And why there should not\\nbe a \\\"fake\\\" 33 command-long queue size.\\n\\nIdeally, the dw driver should account for the ATA_TAG_INTERNAL.\\nIn Damien Le Moal\u0027s words: \\\"... having looked at the driver, it\\nis a bigger change than just faking a 33rd \\\"tag\\\" that is in fact\\nnot a command tag at all.\\\"\\n\\nBugLink: https://github.com/openwrt/openwrt/issues/9505\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ata: sata_dwc_460ex: Se corrige un fallo debido a que el controlador usa valores de \\\"etiqueta\\\" de libata en varias matrices debido a que la correcci\u00f3n mencionada aument\u00f3 ATA_TAG_INTERNAL a 32. Por lo tanto, el valor de SATA_DWC_QCMD_MAX debe tenerlo en cuenta. De lo contrario, el uso de ATA_TAG_INTERNAL causa fallos similares a este, seg\u00fan lo informado por Tice Rex en el foro OpenWrt y reproducido (con s\u00edmbolos) aqu\u00ed: | ERROR: Desreferencia de puntero NULL del kernel en 0x00000000 | Direcci\u00f3n de instrucci\u00f3n con error: 0xc03ed4b8 | Vaya: Acceso del kernel a un \u00e1rea incorrecta, firma: 11 [#1] | BE PAGE_SIZE=4K PowerPC 44x Platform | CPU: 0 PID: 362 Comm: scsi_eh_1 No contaminado 5.4.163 #0 | NIP: c03ed4b8 LR: c03d27e8 CTR: c03ed36c | REGS: cfa59950 TRAP: 0300 No contaminado (5.4.163) | MSR: 00021000  CR: 42000222 XER: 00000000 | DEAR: 00000000 ESR: 00000000 | GPR00: c03d27e8 cfa59a08 cfa55fe0 00000000 0fa46bc0 [...] | [..] | Rastreo de llamadas: | [cfa59a08] [c003f4e0] __cancel_work_timer+0x124/0x194 (no confiable) | [cfa59a78] [c03d27e8] ata_qc_issue+0x1c8/0x2dc | [cfa59a98] [c03d2b3c] ata_exec_internal_sg+0x240/0x524 | [cfa59b08] [c03d2e98] ata_exec_internal+0x78/0xe0 | [cfa59b58] [c03d30fc] ata_read_log_page.part.38+0x1dc/0x204 | [cfa59bc8] [c03d324c] ata_identify_page_supported+0x68/0x130 | [...] Esto se debe a que sata_dwc_dma_xfer_complete() convierte en NULL el pr\u00f3ximo vecino \\\"chan\\\" de dma_pending (una estructura *dma_chan) en este caso \u002732\u0027 aqu\u00ed mismo (l\u00ednea ~735): \u0026gt; hsdevp-\u0026gt;dma_pending[tag] = SATA_DWC_DMA_PENDING_NONE; Luego, la pr\u00f3xima vez que se emite un dma; dma_dwc_xfer_setup() pasa el hsdevp-\u0026gt;chan convertido en NULL a dmaengine_slave_config() que luego causa el bloqueo. Con este parche, SATA_DWC_QCMD_MAX ahora est\u00e1 configurado en ATA_MAX_QUEUE + 1. Esto evita el OOB. Pero tenga en cuenta que hubo una discusi\u00f3n valiosa sobre qu\u00e9 son ATA_TAG_INTERNAL y ATA_MAX_QUEUE. Y por qu\u00e9 no deber\u00eda haber un tama\u00f1o de cola \\\"falso\\\" de 33 comandos. Idealmente, el controlador dw deber\u00eda tener en cuenta ATA_TAG_INTERNAL. En palabras de Damien Le Moal: \\\"... despu\u00e9s de observar el controlador, es un cambio m\u00e1s grande que simplemente falsificar una \\\"etiqueta\\\" n\u00famero 33 que, de hecho, no es una etiqueta de comando en absoluto\\\". Enlace de error: https://github.com/openwrt/openwrt/issues/9505\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/ata/sata_dwc_460ex.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"28361c403683c2b00d4f5e76045f3ccd299bf99d\",\"lessThan\":\"596c7efd69aae94f4b0e91172b075eb197958b99\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"28361c403683c2b00d4f5e76045f3ccd299bf99d\",\"lessThan\":\"55e1465ba79562a191708a40eeae3f8082a209e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"28361c403683c2b00d4f5e76045f3ccd299bf99d\",\"lessThan\":\"fc629224aa62f23849cae83717932985ac51232d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"28361c403683c2b00d4f5e76045f3ccd299bf99d\",\"lessThan\":\"8a05a6952ecd59aaa62cbdcdaf523ae2c8f436e8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"28361c403683c2b00d4f5e76045f3ccd299bf99d\",\"lessThan\":\"234c0132f76f0676d175757f61b0025191a3d935\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"28361c403683c2b00d4f5e76045f3ccd299bf99d\",\"lessThan\":\"3a8751c0d4e24129e72dcec0139e99833b13904a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"28361c403683c2b00d4f5e76045f3ccd299bf99d\",\"lessThan\":\"7aa8104a554713b685db729e66511b93d989dd6a\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/ata/sata_dwc_460ex.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"4.19.238\",\"lessThanOrEqual\":\"4.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.189\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.111\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.34\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.16.20\",\"lessThanOrEqual\":\"5.16.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.17.3\",\"lessThanOrEqual\":\"5.17.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.18\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.18\",\"versionEndExcluding\":\"4.19.238\",\"matchCriteriaId\":\"767A1BFF-2D40-4BAB-945E-ACD1183BC6C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.20\",\"versionEndExcluding\":\"5.4.189\",\"matchCriteriaId\":\"8CB6E8F5-C2B1-46F3-A807-0F6104AC340F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.111\",\"matchCriteriaId\":\"96258501-7BCE-4C55-8A38-8AC9D327626D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.34\",\"matchCriteriaId\":\"D25878D3-7761-4E9F-8919-E92CD53896E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.16.20\",\"matchCriteriaId\":\"ABBBA66E-0244-4621-966B-9790AF1EEB00\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"5.17.3\",\"matchCriteriaId\":\"AE420AC7-1E59-4398-B84F-71F4B4337762\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:5.18:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"6AD94161-84BB-42E6-9882-4FC0C42E9FC1\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/234c0132f76f0676d175757f61b0025191a3d935\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3a8751c0d4e24129e72dcec0139e99833b13904a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/55e1465ba79562a191708a40eeae3f8082a209e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/596c7efd69aae94f4b0e91172b075eb197958b99\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7aa8104a554713b685db729e66511b93d989dd6a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a05a6952ecd59aaa62cbdcdaf523ae2c8f436e8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fc629224aa62f23849cae83717932985ac51232d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-06-30T10:37:28+00:00",
      "cve": "CVE-2022-49073",
      "id": "CVE-2022-49073",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ata: sata_dwc_460ex: Fix crash due to OOB write",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49073.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T01:34:23Z",
      "cve": "CVE-2022-49073",
      "id": "CVE-2022-49073",
      "initial_release_date": "2025-02-27T03:12:42Z",
      "product_status:known_affected": "360",
      "product_status:known_not_affected": "343",
      "product_status:recommended": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49073",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49073.json",
      "version": "49"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.