CVE-2022-49035

What it actually does

The s5p_cec driver fails to enforce an upper bound on msg.len before processing, allowing values larger than CEC_MAX_MSG_SIZE and enabling out-of-bounds memory reads.

Why it matters to the business

Local users or compromised processes could read kernel memory contents, increasing the risk of information disclosure on systems using the affected CEC hardware driver.

How an attack unfolds

An attacker with local access crafts or supplies a CEC message whose length field exceeds the expected maximum; the driver copies or accesses the message without bounds checking, resulting in an out-of-bounds read that may leak kernel data.

How to fix it

Update to a kernel containing commit 7ccb40f26cbefa1c6dfd3418bea54c9518cdbd8a or apply the equivalent backport that adds the CEC_MAX_MSG_SIZE length check in media/s5p_cec.

How to confirm the fix worked

Confirm the presence of the length-limiting check before msg processing in drivers/media/cec/platform/s5p/s5p_cec.c and verify the running kernel version matches a fixed release.

Typical attack path

1. Obtain local execution or user-level access on a system exposing the s5p_cec device
2. Trigger or inject a CEC message with an oversized len field through the device interface
3. Read resulting kernel memory contents leaked by the out-of-bounds access

How to detect it

Review kernel logs for s5p_cec or CEC message length warnings; inspect local process activity that opens CEC devices and correlates with unexpected memory access patterns.

What your security team should do

• Apply the referenced kernel commit or distribution update on all systems using the s5p_cec driver
• Restrict unprivileged access to /dev/cec* nodes via device permissions until patches are deployed
• Monitor EPSS and exploit maturity indicators; no immediate KEV action required given low scores and age