CVE-2022-23086

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size header. Other heap content would be overwritten if the specified size was too small.

Users with access to the mpr, mps or mpt device node may overwrite heap data, potentially resulting in privilege escalation. Note that the device node is only accessible to root and members of the operator group.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787 CWE-122

Affected software

No affected versions have been published.

Timeline

Published: Feb 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2022

CVE-2022-230878.8The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertio CVE-2022-230889.8The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. W CVE-2022-230894.7When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not prope CVE-2022-23097.5NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together CVE-2022-230907.7The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may CVE-2022-230914.0A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different r CVE-2022-230928.8The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing CVE-2022-230936.5ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to rec CVE-2022-230947.5Libreswan 4.2 through 4.5 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted IKE CVE-2022-230957.8Open Design Alliance Drawings SDK before 2022.12.1 mishandles the loading of JPG files. Unchecked input data from a crafted JPG file leads t CVE-2022-230969.1An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of suff CVE-2022-230979.1An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds r