CVE-2022-49122

A vulnerability was found in the Linux kernel's dm-ioctl interface in the lookup_ioctl() function, which accepts a user-provided cmd value that is used to index the _ioctls array directly. This issue could lead to an out-of-bounds access if the CPU speculatively executes the array access before cmd is confirmed as valid, allowing an attacker to exploit a Spectre v1 gadget attack.

Red Hat has rated this vulnerability with a security impact of Moderate. All Red Hat products are being evaluated for impact and Red Hat will work with the Linux community to analyze and correct any issues found.

Successful exploitation of this flaw requires the attacker to have advanced knowledge of the software versions used on the system.

For additional information about this flaw, including possible mitigations, please refer to: https://access.redhat.com/solutions/3545361

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.