Security readout for executives and security teams
Plain-English summary
This Linux kernel flaw can let a faulty or unexpected SCMI reset-domain request access reset-domain data outside valid bounds. On affected ARM-oriented systems, that creates risk to confidentiality, integrity, and availability. The sources show kernel hardening fixes, but no evidence of active exploitation or a named workaround.
Executive priority
Treat this as a high-priority kernel maintenance issue for ARM/Linux fleets and affected appliances. There is no supplied evidence of active exploitation, but the impact rating is high and remediation should be tracked through normal emergency or accelerated patch governance.
Technical view
CVE-2022-48655 is a CWE-125 out-of-bounds access issue in Linux firmware arm_scmi reset-domain handling. The kernel fix adds an internal consistency check before reset-domain descriptor access by index. The CVSS 3.1 score is 8.1 with high complexity and no required privileges or user interaction.
Likely exposure
Exposure is most relevant to Linux systems or appliances using ARM SCMI firmware reset-domain functionality. The bundle names Linux kernel versions and includes Debian LTS and NetApp advisories, but exact product and package impact must be confirmed through each vendor's guidance.
Exploitation context
The CVE is not listed as KEV in the supplied bundle, and no cited source states active exploitation. Exploitation details are not provided. The described condition depends on SCMI driver behavior and invalid reset-domain index handling, so practical exploitability is unclear from these sources.
Researcher notes
The source bundle provides the vulnerability cause, CWE, CVSS, affected Linux version data, and stable commit references. It does not provide exploitability analysis, proof of concept, runtime indicators, or complete downstream package mappings. Validate exposure through kernel configuration, code provenance, and vendor advisories.
Mitigation direction
- Update affected Linux kernels to vendor-supported builds containing the referenced stable fixes.
- Check Debian, NetApp, and other vendor advisories for package-specific remediation guidance.
- Prioritize ARM platforms and appliances that rely on SCMI firmware reset controls.
- If patching is delayed, follow vendor guidance; no source-provided workaround is named.
Validation and detection
- Inventory Linux kernel versions and vendor appliance firmware against the CVE record.
- Confirm whether ARM SCMI reset-domain support is present and in use.
- Verify patched builds include the referenced kernel stable commits or vendor backports.
- Review vendor advisories for distribution-specific fixed package versions.
- Document any systems where applicability cannot be confirmed from available evidence.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-48655 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H2.25.9CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
8.1HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/7184491fc515f391afba23d0e9b690caaea72dafCVE reference, Linux
- https://git.kernel.org/stable/c/f2277d9e2a0d092c13bae7ee82d75432bb8b5108CVE reference, Linux
- https://git.kernel.org/stable/c/1f08a1b26cfc53b7715abc46857c6023bb1b87deCVE reference, Linux
- https://git.kernel.org/stable/c/8e65edf0d37698f7a6cb174608d3ec7976baf49eCVE reference, Linux
- https://git.kernel.org/stable/c/e9076ffbcaed5da6c182b144ef9f6e24554af268CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2024/06/msg00019.htmlCVE reference, CVE · x_transferred
- https://security.netapp.com/advisory/ntap-20240912-0008/CVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.