CVE-2022-48655

What it actually does

Missing bounds check on reset domain index allows out-of-bounds descriptor access when an SCMI driver issues reset operations, resulting in memory corruption.

Why it matters to the business

Local compromise of Linux-based ARM systems using SCMI firmware can lead to privilege escalation or crashes, affecting embedded devices, servers, and Android kernels with high ecosystem prevalence.

How an attack unfolds

An attacker with local access supplies a crafted or misbehaving SCMI reset request that references an out-of-range domain index; the kernel then reads or writes beyond the allocated descriptor array, enabling memory corruption that can be leveraged for code execution.

How to fix it

Upgrade the Linux kernel to the commit 7184491fc515f391afba23d0e9b690caaea72daf or later stable releases that contain the internal consistency check for reset-domain accesses.

How to confirm the fix worked

Verify the running kernel contains commit 7184491fc515f391afba23d0e9b690caaea72daf; confirm SCMI reset operations now perform index validation before descriptor access via source inspection or kernel version checks.

Typical attack path

1. Obtain local code execution on a vulnerable Linux kernel
2. Load or trigger a misbehaving SCMI driver that issues reset-domain requests
3. Supply an index outside the valid reset-domain range
4. Trigger out-of-bounds descriptor access to corrupt kernel memory
5. Escalate privileges or achieve persistence via the resulting corruption

How to detect it

Review kernel logs and audit trails for unexpected SCMI reset operation failures or oops messages referencing reset domains; examine crash dumps for out-of-bounds accesses in arm_scmi reset code paths.

What your security team should do

• Apply the fixed kernel version immediately on all ARM systems using SCMI
• Prioritize patching devices exposed to local attackers or running Android kernels
• Monitor for kernel updates in stable trees and rebuild custom images
• Test SCMI-enabled hardware after upgrade to ensure reset functionality remains intact