CVE-2022-39842: Linux Kernel Buffer Overflow Vulnerability

CVE-2022-39842 Overview

CVE-2022-39842 is an integer overflow vulnerability in the Linux kernel before version 5.19. The flaw resides in the pxa3xx_gcu_write function in drivers/video/fbdev/pxa3xx-gcu.c. The count parameter has a type conflict between size_t and int, which causes an integer overflow that bypasses a size check. The unchecked value is then passed as the third argument to copy_from_user(), potentially leading to a heap overflow. The original discoverer disputes whether the overflow can actually be triggered in practice. The issue affects Linux kernel builds shipped with Debian 10 and Debian 11.

Critical Impact
A local authenticated attacker with access to the PXA3xx graphics controller unit device may trigger a heap overflow through crafted write operations, impacting kernel availability and integrity [CWE-190].

Affected Products

Linux kernel versions prior to 5.19
Linux kernel 5.19 release candidates (rc1, rc2, rc3)
Debian Linux 10 and 11

Discovery Timeline

2022-09-05 - CVE-2022-39842 published to NVD
2022-10 - Debian LTS security announcement issued
2022-11 - Follow-up Debian LTS security announcement issued
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-39842

Vulnerability Analysis

The vulnerability lives in the framebuffer driver for the Marvell PXA3xx graphics control unit. When user space writes data through the device file, the kernel's pxa3xx_gcu_write function receives the byte count as a size_t value but stores an intermediate value (words = count / 4) in a signed int variable. The driver then uses this int in a bounds comparison before passing the original count to copy_from_user() into a fixed-size heap buffer. Large size_t values can produce a signed integer whose comparison succeeds while the underlying copy_from_user() call overruns the destination buffer.

Root Cause

The root cause is a signed/unsigned type confusion combined with truncation [CWE-190]. By declaring words as int rather than size_t, the driver allowed values from a 64-bit unsigned count to be interpreted as smaller signed values during the size check. The upstream fix changes the declaration to size_t words, eliminating the truncation.

Attack Vector

Exploitation requires local access and write permissions on the /dev/pxa3xx-gcu character device. The attack vector is constrained to systems running the Marvell PXA3xx framebuffer driver, which is a niche embedded platform. Successful exploitation may corrupt kernel heap memory adjacent to the pxa3xx_gcu_batch buffer, producing a denial of service or unpredictable kernel state.

// Upstream patch: drivers/video/fbdev/pxa3xx-gcu.c
// commit a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7
 	struct pxa3xx_gcu_batch	*buffer;
 	struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file);
 
-	int words = count / 4;
+	size_t words = count / 4;
 
 	/* Does not need to be atomic. There's a lock in user space,
 	 * but anyhow, this is just for statistics. */
// Source: https://github.com/torvalds/linux/commit/a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7

Detection Methods for CVE-2022-39842

Indicators of Compromise

Unexpected kernel oops or panic messages referencing pxa3xx_gcu_write or pxa3xx-gcu in dmesg output.
Slab corruption warnings from the kernel allocator on systems exposing the /dev/pxa3xx-gcu device.
Unprivileged processes performing large write() syscalls against the PXA3xx GCU character device.

Detection Strategies

Inventory Linux hosts to identify kernels older than 5.19 with the CONFIG_FB_PXA3XX_GCU driver loaded via lsmod or /proc/modules.
Audit auditd or eBPF telemetry for openat and write syscalls targeting /dev/pxa3xx-gcu from non-root users.
Correlate kernel ring buffer logs with process execution telemetry to flag anomalous interactions with the framebuffer driver.

Monitoring Recommendations

Forward kernel logs and audit records to a centralized analytics platform for retention and rule-based alerting.
Alert on repeated kernel slab or page allocator warnings originating from framebuffer drivers.
Track patch state across the fleet to confirm hosts have moved to a fixed kernel package.

How to Mitigate CVE-2022-39842

Immediate Actions Required

Upgrade affected systems to Linux kernel 5.19 or apply the distribution backport that includes commit a09d2d00af53.
For Debian 10 and 11, install the kernel updates referenced in Debian Security Advisory DSA-5257 and the Debian LTS Announcement October 2022.
Restrict access to the /dev/pxa3xx-gcu device node to trusted users only.

Patch Information

The upstream fix is commit a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7, which changes the words variable in pxa3xx_gcu_write from int to size_t. Reference the Linux Kernel ChangeLog 5.19 and the GitHub Linux Commit Log for details. Debian users should track the Debian LTS Announcement November 2022 for backported package versions.

Workarounds

Unload the pxa3xx-gcu kernel module on systems that do not require Marvell PXA3xx graphics functionality using modprobe -r pxa3xx-gcu.
Blacklist the module in /etc/modprobe.d/ to prevent it from loading at boot.
Tighten device node permissions on /dev/pxa3xx-gcu so only privileged service accounts can issue write operations.

bash

# Blacklist the vulnerable driver until patches are applied
echo "blacklist pxa3xx-gcu" | sudo tee /etc/modprobe.d/blacklist-pxa3xx-gcu.conf
sudo modprobe -r pxa3xx-gcu

# Restrict access to the device node if the driver must remain loaded
sudo chmod 600 /dev/pxa3xx-gcu
sudo chown root:root /dev/pxa3xx-gcu