Security readout for executives and security teams
Plain-English summary
This is a Linux kernel flaw in ARM SCMI firmware protocol discovery. A local user with low privileges could trigger an availability impact if the platform returns an oversized protocol count. The practical concern is denial of service on affected ARM-based Linux systems, not data theft or remote compromise.
Executive priority
Treat as a moderate operational reliability issue. Prioritize patching shared ARM Linux platforms, edge devices, and multi-tenant systems where local users or workloads could trigger a denial of service.
Technical view
The ARM SCMI base protocol enumeration used unsigned addition while validating returned protocol counts. A large loop_num_ret value could overflow the check and bypass validation. The CVE maps this to CWE-190 with CVSS 5.5: local attack vector, low complexity, low privileges, no confidentiality or integrity impact, and high availability impact.
Likely exposure
Exposure is most relevant to Linux systems using the ARM SCMI firmware driver. The source lists Linux kernel versions including 4.17, 4.19.247, 5.4.198, 5.10.121, 5.15.46, 5.17.14, 5.18.3, and 5.19. Distro backports may change exact status.
Exploitation context
The CVE is not listed as KEV in the supplied data, and no provided source claims active exploitation. The CVSS vector requires local access and low privileges. The supported impact is availability loss only; the bundle does not show remote exploitation, data exposure, or privilege escalation.
Researcher notes
Validation should focus on kernel source lineage and distro backports, because the CVE bundle lists upstream stable commits but not downstream package names. Avoid assuming exposure on non-ARM systems or systems not using SCMI firmware paths.
Mitigation direction
- Identify ARM Linux assets using the SCMI firmware driver.
- Update kernels using vendor or Linux stable guidance for this CVE.
- Confirm distro kernel backports before relying on upstream version numbers.
- Prioritize systems where local users or workloads are untrusted.
Validation and detection
- Inventory kernel versions on ARM-based Linux hosts.
- Check vendor advisories or changelogs for CVE-2022-49451 coverage.
- Verify whether ARM SCMI firmware support is enabled or in use.
- Confirm patched stable commits are present in deployed kernel sources.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49451 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8CVE reference, Linux
- https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceecCVE reference, Linux
- https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ffCVE reference, Linux
- https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9fCVE reference, Linux
- https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247CVE reference, Linux
- https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3fCVE reference, Linux
- https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.