Security readout for executives and security teams
Plain-English summary
CVE-2022-49885 is a Linux kernel availability bug in ACPI APEI/GHES initialization. An integer overflow can lead to an impossible vmalloc size and allocation failure. The cited record rates it medium, with local low-privilege attack requirements and high availability impact, but no evidence of active exploitation is provided.
Executive priority
Treat as routine but real availability risk. It does not warrant emergency response without additional exploitation evidence, but kernel update programs should include it, especially for shared Linux systems or environments running untrusted local workloads.
Technical view
In ghes_estatus_pool_init(), signed int multiplication of num_ghes and GHES_ESOURCE_PREALLOC_MAX_SIZE can overflow while calculating len. The fix changes num_ghes to unsigned int so the pool sizing calculation avoids overflow and subsequent vmalloc failure. The issue is classified as CWE-190.
Likely exposure
Exposure is limited to systems running affected Linux kernel versions or distro kernels that have not backported the stable fixes. The bundle does not map exposure to specific distributions, appliances, or cloud images.
Exploitation context
The CVSS vector is local, low complexity, low privilege, no user interaction, with availability-only impact. KEV is false, and the supplied sources do not show active exploitation or a practical public trigger path.
Researcher notes
The strongest evidence is the upstream Linux fix and CVSS vector. The source bundle does not explain how an attacker controls num_ghes, so practical exploitability should be validated cautiously against affected hardware, firmware tables, and vendor kernel backports.
Mitigation direction
- Update to a Linux kernel containing the referenced stable fixes.
- Check vendor or distribution advisories for backported kernel package status.
- Prioritize systems where local users can run untrusted workloads.
- Track kernel boot or ACPI initialization failures during rollout.
- Do not assume distro version numbers match upstream kernel ranges.
Validation and detection
- Inventory running kernel versions across Linux hosts.
- Compare kernel builds against vendor advisories and referenced stable commits.
- Review dmesg for vmalloc failures near ghes_estatus_pool_init or acpi_hest_init.
- Confirm patched kernels boot cleanly on ACPI APEI/GHES-capable hardware.
- Document any systems requiring vendor-maintained older kernels.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-190: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49885 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/9edf20e5a1d805855e78f241cf221d741b50d482CVE reference, Linux
- https://git.kernel.org/stable/c/c50ec15725e005e9fb20bce69b6c23b135a4a9b7CVE reference, Linux
- https://git.kernel.org/stable/c/4c10c854113720cbfe75d4f51db79b700a629e73CVE reference, Linux
- https://git.kernel.org/stable/c/43d2748394c3feb86c0c771466f5847e274fc043CVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Integer Overflow or Wraparound
Integer Overflow or Wraparound represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.