CVE-2022-49032
Description
In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278 Call Trace: afe4404_read_raw iio_read_channel_info dev_attr_show The buggy address belongs to the variable: afe4404_channel_leds+0x18/0xffffffffffffe9c0 This issue can be reproduce by singe command: $ cat /sys/bus/i2c/devices/0-0058/iio\:device0/in_intensity6_raw The array size of afe4404_channel_leds and afe4404_channel_offdacs are less than channels, so access with chan->address cause OOB read in afe4404_[read|write]_raw. Fix it by moving access before use them.
How to fix
- linux linux_kernel4.9.335, 4.14.301, 4.19.268, 5.4.226, 5.10.158, 5.15.82, 6.0.12 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 4.8 ≤ v < 4.9.335, 4.10 ≤ v < 4.14.301, 4.15 ≤ v < 4.19.268, 4.20 ≤ v < 5.4.226, 5.5 ≤ v < 5.10.158, 5.11 ≤ v < 5.15.82, 5.16 ≤ v < 6.0.12, 6.1 | 4.9.335, 4.14.301, 4.19.268, 5.4.226, 5.10.158, 5.15.82, 6.0.12 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.