CVE-2022-49612·Kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved: power: supply: core: Fix boundary conditions in interpolation The functions power_supply_temp2resist_simple and power_supply_ocv2cap_simple handle boundary conditions incorrectly. The change was introduced in a4585ba2050f460f749bbaf2b67bd56c41e30283 ("power: supply: core: Use library interpolation"). There are two issues: First, the lines "high = i - 1" and "high = i" in ocv2cap have the wrong order compared to temp2resist. As a consequence, ocv2cap sets high=-1 if ocv>table[0].ocv, which causes an out-of-bounds read. Second, the logic of temp2resist is also not correct. Consider the case table[] = {{20, 100}, {10, 80}, {0, 60}}. For temp=5, we expect a resistance of 70% by interpolation. However, temp2resist sets high=low=2 and returns 60.
- Severity
- high
- Software
- Kernel
- Fixed in
- 5.18.13
- Published
- 2025-02-26
Affected versions
From: 5.17
Until: 5.18.13
Fixed in: 5.18.13
How to fix this CVE
Update your Linux kernel to version 5.18.13 or later to resolve incorrect boundary condition handling in power supply interpolation functions. This vulnerability affects kernel versions 5.17 through 5.18.12 and can cause out-of-bounds memory reads and incorrect power management calculations. Apply the patch promptly as the affected code path is triggered during normal system power supply monitoring operations.
sudo dnf update kernel kernel-devel && sudo rebootDefensia detects this vulnerability
How to check if you are affected
- Check installed kernel version: uname -r — vulnerable if output is between 5.17.0 and 5.18.12
- Verify if power supply core module is loaded: lsmod | grep power_supply — if present, the vulnerable code path may be active
- Review kernel messages for memory access errors: dmesg | grep -i 'fault\|segfault\|oops\|power_supply' — look for crashes in power supply functions
- Confirm patch application: grep -i 'ocv2cap_simple\|temp2resist' /boot/config-$(uname -r) — fixed version should have corrected boundary logic or function removal
FAQ
What is CVE-2022-49612?
CVE-2022-49612 is a kernel vulnerability in power supply interpolation functions where boundary condition checks were implemented incorrectly, causing out-of-bounds memory reads and incorrect resistance/capacity calculations. The flaw affects systems using battery management or power monitoring features.
Is CVE-2022-49612 being actively exploited?
No, CVE-2022-49612 is not currently listed in CISA's Known Exploited Vulnerabilities catalog and no public exploits are available. However, the high CVSS score (7.8) indicates local privilege escalation potential that warrants urgent patching.
What versions of Kernel are affected by CVE-2022-49612?
Linux kernel versions 5.17.0 through 5.18.12 are vulnerable. The issue was introduced in commit a4585ba2050f460f749bbaf2b67bd56c41e30283 and fixed in version 5.18.13 and later.
How do I check if my server is vulnerable to CVE-2022-49612?
Run 'uname -r' and compare your kernel version to the range 5.17.0-5.18.12; if your version falls within this range, your system is vulnerable. Additionally, check if battery or power supply monitoring is enabled on your system.
Does Defensia detect CVE-2022-49612?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Kernel is installed on a monitored server, CVE-2022-49612 will appear in your dashboard with remediation steps.
Related Kernel CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2022-49612. Free for 1 server.
Get started free