CVE-2022-49073 is a vulnerability identified in the Linux kernel's SATA driver, specifically in the sata_dwc_460ex driver which handles SATA devices using the DesignWare Cores 460EX SATA controller. The root cause of the vulnerability is an out-of-bounds (OOB) write triggered by improper handling of ATA tag values within the driver. The Linux kernel uses libata's "tag" values to index various arrays related to command queueing for ATA devices. A recent patch increased the value of ATA_TAG_INTERNAL to 32, but the SATA_DWC_QCMD_MAX constant, which defines the maximum queue size for the driver, was not updated accordingly. This mismatch leads to an OOB write when the driver attempts to access or modify array elements beyond their allocated bounds. Specifically, the vulnerability manifests when sata_dwc_dma_xfer_complete() function nullifies a dma_pending entry corresponding to a tag value, and subsequent DMA operations attempt to use a NULL dma_chan pointer, causing a kernel NULL pointer dereference and crash (kernel oops). The crash logs indicate a faulting instruction in sata_dwc_qc_issue(), which is part of the command issuance path. The vulnerability can cause system instability and denial of service due to kernel crashes. The patch to fix this issue involves increasing SATA_DWC_QCMD_MAX to ATA_MAX_QUEUE + 1, thereby preventing OOB access. However, this is a workaround rather than a full architectural fix, as the driver should ideally be refactored to properly handle ATA_TAG_INTERNAL without relying on a "fake" extended queue size. The vulnerability was reported and reproduced on OpenWrt systems running Linux kernel 5.4.163 on PowerPC 44x platforms, but the underlying issue affects the Linux kernel SATA driver codebase. No known exploits are currently reported in the wild, and no CVSS score has been assigned yet.

For European organizations, this vulnerability poses a risk primarily to systems running Linux kernels with the affected sata_dwc_460ex driver, which is common in embedded devices, network equipment, and some server environments using DesignWare SATA controllers. The impact is mainly denial of service through kernel crashes, which can disrupt critical services, cause data loss if crashes occur during disk operations, and potentially lead to system instability. Organizations relying on embedded Linux devices such as routers, industrial control systems, or specialized hardware with this SATA controller are particularly at risk. While this vulnerability does not directly enable privilege escalation or remote code execution, the resulting denial of service can have significant operational impacts, especially in environments requiring high availability. Additionally, the crash could be triggered remotely if an attacker can induce SATA commands that exercise the vulnerable code path, increasing the threat surface. European sectors such as telecommunications, manufacturing, and critical infrastructure that deploy embedded Linux devices with this hardware are most vulnerable. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed promptly to prevent potential exploitation and service disruption.

1. Apply the official Linux kernel patches that fix the SATA driver by adjusting SATA_DWC_QCMD_MAX to ATA_MAX_QUEUE + 1 or later kernel versions where this vulnerability is resolved. 2. For embedded devices or systems where kernel upgrades are challenging, coordinate with device vendors or maintainers to obtain patched firmware or kernel images. 3. Implement monitoring for kernel oops or crashes related to SATA operations to detect potential exploitation attempts or instability. 4. Restrict access to systems with affected hardware to trusted users and networks to reduce the risk of triggering the vulnerability. 5. Conduct thorough testing of updated kernels in staging environments before deployment to ensure stability and compatibility. 6. For critical systems, consider fallback or redundancy mechanisms to maintain availability in case of unexpected crashes. 7. Engage with hardware and software vendors to confirm whether their products are affected and track updates. 8. Review and harden system configurations to minimize exposure of SATA device interfaces to untrusted inputs or remote attackers.