CVE-2022-49885 is a vulnerability in the Linux kernel related to the ACPI (Advanced Configuration and Power Interface) subsystem, specifically within the APEI (ACPI Platform Error Interface) component. The flaw exists in the function ghes_estatus_pool_init(), where an integer overflow occurs due to the use of signed integers in a multiplication operation. The variable num_ghes, originally declared as a signed int, is multiplied by a constant GHES_ESOURCE_PREALLOC_MAX_SIZE, also a signed int, to calculate the length (len) for memory allocation. This calculation can overflow, resulting in an incorrect, extremely large value for len. Consequently, the subsequent vmalloc() call attempts to allocate an invalidly large memory size, which fails and triggers kernel warnings and errors. The root cause is the signed integer overflow during length calculation, which was fixed by changing num_ghes to an unsigned int, preventing the overflow and ensuring correct memory allocation. The vulnerability can cause kernel instability or denial of service (DoS) due to failed memory allocation and potential kernel panics during system initialization or ACPI error handling. The call trace provided shows the failure occurring during kernel initialization, indicating that affected systems may fail to boot or operate reliably. No known exploits are reported in the wild, and no CVSS score has been assigned yet. The vulnerability affects Linux kernel versions identified by the given commit hashes, which correspond to recent kernel versions prior to the patch. This issue is technical and specific to the Linux kernel's ACPI error handling mechanism, impacting systems that rely on this kernel code path.

For European organizations, the impact of CVE-2022-49885 primarily involves potential system instability and denial of service on Linux-based servers, desktops, and embedded devices that utilize affected kernel versions. Organizations running Linux kernels with the vulnerable code in environments where ACPI error handling is active may experience boot failures or kernel crashes, leading to downtime and disruption of critical services. This can affect data centers, cloud providers, telecommunications infrastructure, and industrial control systems that rely on Linux. The denial of service could impact availability of services, causing operational delays and potential financial losses. Since the vulnerability is in the kernel, it affects the integrity and availability of systems rather than confidentiality. Although no remote code execution or privilege escalation is indicated, the inability to allocate memory correctly during kernel initialization can prevent systems from functioning properly. European organizations with large Linux deployments, especially those using custom or older kernels without the patch, are at risk. The lack of known exploits reduces immediate threat but does not eliminate risk, especially as attackers may develop exploits targeting this flaw. The impact is more severe in environments where high availability is critical, such as financial institutions, healthcare, and government infrastructure.

To mitigate CVE-2022-49885, European organizations should prioritize updating their Linux kernels to versions that include the patch fixing the integer overflow in ghes_estatus_pool_init(). Kernel updates from trusted Linux distributions or direct application of the patch from the Linux kernel maintainers should be applied promptly. Organizations using custom kernels should backport the fix by changing the num_ghes variable to unsigned int as per the patch. Additionally, thorough testing of kernel updates in staging environments is recommended to ensure stability before production deployment. Monitoring kernel logs for vmalloc errors or ACPI-related warnings can help detect attempts to trigger the vulnerability. For critical systems where immediate patching is not feasible, consider isolating affected systems or limiting exposure to untrusted inputs that might trigger ACPI error handling. Implementing robust backup and recovery procedures will reduce downtime in case of system crashes. Finally, maintain awareness of Linux kernel advisories and subscribe to security mailing lists to receive timely updates on this and related vulnerabilities.