CVE-2022-50315

A flaw was discovered in the Linux kernel’s AHCI driver subsystem.The driver allocated an array of 8 elements (ahci_em_priv[8]), but under certain SATA Port Multiplier (PMP) configurations, the code in sata_pmp_init_links() could index up to SATA_PMP_MAX_PORTS (which may exceed 8), triggering a potential array-index-out-of-bounds condition. This could result in memory corruption and compromise of system integrity or availability.

This vulnerability is rated as Moderate severity rather than Low because successful exploitation can cause memory corruption leading to a kernel crash and denial of service. The issue requires specific hardware configurations involving SATA Port Multipliers connected to an AHCI host controller with enclosure management active. On typical enterprise installations where standard direct-attached storage or NVMe drives are utilized without port multipliers, this flawed code path is not exercised.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.