CVE-2022-49945: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-49945 is an out-of-bounds array access vulnerability in the Linux kernel's hardware monitoring (hwmon) GPIO fan driver (gpio-fan). The driver fails to validate whether the cooling state value passed to gpio_fan_set_cur_state() exceeds the maximum cooling state stored in fan_data->num_speeds, allowing the unchecked value to be used as an array index in set_fan_speed(). Affected kernel versions span from 4.1 up to (but not including) the fixed releases: 4.9.328, 4.14.293, 4.19.258, 5.4.213, 5.10.142, 5.15.66, and 5.19.8, as well as release candidates 6.0-rc1 through 6.0-rc3. It carries a CVSS v3.1 base score of 7.1 (High) (Feedly, CIRCL).

The root cause is classified as CWE-125 (Out-of-bounds Read). The gpio_fan_set_cur_state() function in the hwmon GPIO fan driver accepts a user-controlled cooling state integer from the thermal framework's sysfs interface without bounds checking against fan_data->num_speeds. When this unchecked value is subsequently used as an array index in set_fan_speed(), it can reference memory beyond the allocated array, triggering a kernel oops (e.g., a page fault at an invalid virtual address). The attack vector is local, requiring low privileges — specifically, write access to the thermal cooling device's cur_state sysfs attribute (typically writable by root or a privileged thermal management process) (Feedly).

Successful exploitation can cause a kernel oops (system crash), resulting in a denial of service. In the demonstrated example, the kernel generates an Unable to handle kernel paging request error with an Internal error: Oops at an invalid virtual address, crashing the system. There is also a theoretical risk of memory corruption or unauthorized memory disclosure depending on what resides at the out-of-bounds address, with potential confidentiality and availability impacts rated High (Feedly).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.024% (0.000240), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low privileges and a system that uses the gpio-fan hwmon driver, which limits the practical attack surface primarily to embedded or ARM-based Linux systems (Feedly).

1. Identify target: Locate a Linux system running a vulnerable kernel version (4.1–5.19.7 or 6.0-rc1 through rc3) with the gpio-fan hwmon driver loaded, typically found on embedded or ARM-based hardware (e.g., Raspberry Pi-class devices).
2. Gain local access: Obtain low-privilege local access to the target system (e.g., via SSH, physical console, or an existing foothold).
3. Locate sysfs interface: Find the thermal cooling device node associated with the GPIO fan driver, typically at a path such as /sys/class/thermal/cooling_deviceX/cur_state.
4. Write out-of-bounds value: Write an integer value exceeding the maximum valid cooling state (i.e., greater than fan_data->num_speeds - 1) to the cur_state attribute: echo 9999 > /sys/class/thermal/cooling_deviceX/cur_state.
5. Trigger kernel oops: The kernel's gpio_fan_set_cur_state() passes the unchecked value as an array index to set_fan_speed(), causing an out-of-bounds memory access, resulting in a kernel oops/crash or potential memory corruption (Feedly).

• Logs: Kernel log entries (via dmesg or /var/log/kern.log) showing Unable to handle kernel paging request at virtual address followed by Internal error: Oops with ESR code 0x96000005; stack traces referencing gpio_fan_set_cur_state or set_fan_speed in the hwmon subsystem.
• File System / sysfs: Unusual or extreme values written to /sys/class/thermal/cooling_deviceX/cur_state for GPIO fan cooling devices; audit logs showing writes to this path from unexpected users or processes.
• Process: Unexpected system reboots or kernel panics on embedded/ARM systems with GPIO fan hardware; thermal management daemon crashes or restarts (Feedly).

Update the Linux kernel to a patched version: 4.9.328, 4.14.293, 4.19.258, 5.4.213, 5.10.142, 5.15.66, 5.19.8, or any later stable release. SUSE has issued kernel security advisories (SUSE-2025-02264-1, SUSE-2025-02308-1, SUSE-2025-02537-1) addressing this CVE for their supported kernel packages (SUSE Advisory). As a workaround where patching is not immediately possible, restrict write access to the thermal cooling device sysfs interface (e.g., via file permissions or SELinux/AppArmor policy) and limit local user access on affected embedded systems (Feedly).

Coverage of CVE-2022-49945 has been limited to routine vulnerability database entries and vendor patch advisories, with no notable researcher commentary or significant social media discussion observed. SUSE issued multiple kernel security updates addressing this and related issues, and the vulnerability was included in CISA's weekly vulnerability summary for the week of June 16, 2025 (SUSE Advisory, Red Packet Security).