CVE-2022-49404 – This CVE describes an integer overflow vulnerab... (How to Fix)

Q: What is the severity of CVE-2022-49404?

CVE-2022-49404 has a CVSS score of 5.5 (MEDIUM). This CVE describes an integer overflow vulnerability in the Linux kernel's RDMA/hfi1 driver. An attacker could potentially cause denial of service or system instability by triggering incorrect calculations in inter-packet delay processing. Systems using RDMA (Remote Direct Memory Access) with hfi1 hardware are affected.

📋 TL;DR

This CVE describes an integer overflow vulnerability in the Linux kernel's RDMA/hfi1 driver. An attacker could potentially cause denial of service or system instability by triggering incorrect calculations in inter-packet delay processing. Systems using RDMA (Remote Direct Memory Access) with hfi1 hardware are affected.

💻 Affected Systems

Products:

Linux kernel with RDMA/hfi1 driver

Versions: Linux kernel versions before the fix commits (specific versions vary by distribution)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with RDMA hardware using hfi1 driver. Most standard Linux installations are not affected unless specifically configured for RDMA.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

System crash or kernel panic leading to denial of service, potentially requiring physical reboot of affected systems.

🟠

Likely Case

System instability, packet processing errors, or performance degradation in RDMA operations.

🟢

If Mitigated

Minimal impact with proper network segmentation and limited RDMA exposure.

🌐 Internet-Facing: LOW - RDMA protocols are typically used in internal high-performance computing clusters, not exposed to internet.

🏢 Internal Only: MEDIUM - Internal attackers with RDMA access could potentially trigger the vulnerability in affected clusters.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: HIGH

Exploitation requires RDMA access and ability to trigger specific calculations. No public exploits have been reported.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 06039d8afefdbac05bcea5f397188407eba2996d, 252f4afd4557a2e7075f793a5c80fe6dd9e9ee4a, 31dca00d0cc9f4133320d72eb7e3720badc6d6e6, 3f09ec80f115d2875d747ed28adc1773037e0f8b, 79c164e61f818054cd6012e9035701840d895c51

Vendor Advisory: https://git.kernel.org/stable/c/06039d8afefdbac05bcea5f397188407eba2996d

Restart Required: Yes

Instructions:

1. Update Linux kernel to version containing the fix commits. 2. Check distribution-specific security advisories. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable RDMA/hfi1 module

linux

Prevent loading of the vulnerable driver if RDMA functionality is not required

echo 'blacklist hfi1' >> /etc/modprobe.d/blacklist.conf
rmmod hfi1

Restrict RDMA access

linux

Limit RDMA network access to trusted systems only

iptables -A INPUT -p ib -s untrusted_network -j DROP

🧯 If You Can't Patch

Isolate RDMA networks from untrusted systems
Implement strict access controls for RDMA-enabled systems

🔍 How to Verify

Check if Vulnerable:

Check if hfi1 module is loaded: lsmod | grep hfi1. Check kernel version against distribution security advisories.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Check with: grep -r '06039d8afefdbac05bcea5f397188407eba2996d' /boot/System.map*

📡 Detection & Monitoring

Log Indicators:

Kernel panic logs
RDMA error messages in dmesg
System crash reports

Network Indicators:

Unusual RDMA traffic patterns
Failed RDMA connections

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "hfi1")

📊 Metadata

CVE ID: CVE-2022-49404

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-190

EPSS Score: 0.03% exploit probability (9.4th percentile)

Published: February 26, 2025

Last Updated: October 1, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2022-49404, you might also want to check these: