CVE-2022-49643

In the Linux kernel, the following vulnerability has been resolved:

ima: Fix a potential integer overflow in ima_appraise_measurement

When the ima-modsig is enabled, the rc passed to evm_verifyxattr() may be negative, which may cause the integer overflow problem.

This vulnerability is rated as Moderate impact because exploiting it requires local system access and non-standard configurations involving custom Integrity Measurement Architecture appraisal policies. In default Red Hat Enterprise Linux environments, IMA appraisal with appended signature verification is not enabled. Systems are only potentially exposed if administrators have explicitly enabled appraisal and configured policies supporting appended signatures, restricting the impact primarily to a local denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.