CVE-2022-48772

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48772
In the Linux kernel, the following vulnerability has been resolved: media: lgdt3306a: Add a check against null-pointer-def The driver should check whether the client provides the platform_data. The following log reveals it: [ 29.610324] BUG: KASAN: null-ptr-deref in kmemdup+0x30/0x40 [ 29.610730] Read of size 40 at addr 0000000000000000 by task bash/414 [ 29.612820] Call Trace: [ 29.613030] <TASK> [ 29.613201] dump_stack_lvl+0x56/0x6f [ 29.613496] ? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x52/0x310 [ 29.616339] i2c_device_probe+0x951/0xa90

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/526238d32c3acc3d597fd8c9a34652bfe9086cea Patch
https://git.kernel.org/stable/c/7d12e918f2994c883f41f22552a61b9310fa1e87 Patch
https://git.kernel.org/stable/c/8915dcd29a82096acacf54364a8425363782aea0 Patch
https://git.kernel.org/stable/c/8e1e00718d0d9dd83337300572561e30b9c0d115 Patch
https://git.kernel.org/stable/c/b479fd59a1f4a342b69fce34f222d93bf791dca4 Patch
https://git.kernel.org/stable/c/c1115ddbda9c930fba0fdd062e7a8873ebaf898d Patch
https://git.kernel.org/stable/c/d082757b8359201c3864323cea4b91ea30a1e676 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Sep 2024, 17:51

Type Values Removed Values Added
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: medio: lgdt3306a: agregue una verificación contra null-pointer-def. El controlador debe verificar si el cliente proporciona platform_data. El siguiente registro lo revela: [29.610324] ERROR: KASAN: null-ptr-deref en kmemdup+0x30/0x40 [29.610730] Lectura del tamaño 40 en la dirección 00000000000000000 por tarea bash/414 [29.612820] Seguimiento de llamadas: [29.613030] k &gt; [29.613201] dump_stack_lvl+0x56/0x6f [29.613496]? kmemdup+0x30/0x40 [ 29.613754] print_report.cold+0x494/0x6b7 [ 29.614082] ? kmemdup+0x30/0x40 [ 29.614340] kasan_report+0x8a/0x190 [ 29.614628] ? kmemdup+0x30/0x40 [ 29.614888] kasan_check_range+0x14d/0x1d0 [ 29.615213] memcpy+0x20/0x60 [ 29.615454] kmemdup+0x30/0x40 [ 29.615700] lgdt3306a_probe+0x5 2/0x310 [29.616339] i2c_device_probe+0x951/0xa90
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/526238d32c3acc3d597fd8c9a34652bfe9086cea - () https://git.kernel.org/stable/c/526238d32c3acc3d597fd8c9a34652bfe9086cea - Patch
References () https://git.kernel.org/stable/c/7d12e918f2994c883f41f22552a61b9310fa1e87 - () https://git.kernel.org/stable/c/7d12e918f2994c883f41f22552a61b9310fa1e87 - Patch
References () https://git.kernel.org/stable/c/8915dcd29a82096acacf54364a8425363782aea0 - () https://git.kernel.org/stable/c/8915dcd29a82096acacf54364a8425363782aea0 - Patch
References () https://git.kernel.org/stable/c/8e1e00718d0d9dd83337300572561e30b9c0d115 - () https://git.kernel.org/stable/c/8e1e00718d0d9dd83337300572561e30b9c0d115 - Patch
References () https://git.kernel.org/stable/c/b479fd59a1f4a342b69fce34f222d93bf791dca4 - () https://git.kernel.org/stable/c/b479fd59a1f4a342b69fce34f222d93bf791dca4 - Patch
References () https://git.kernel.org/stable/c/c1115ddbda9c930fba0fdd062e7a8873ebaf898d - () https://git.kernel.org/stable/c/c1115ddbda9c930fba0fdd062e7a8873ebaf898d - Patch
References () https://git.kernel.org/stable/c/d082757b8359201c3864323cea4b91ea30a1e676 - () https://git.kernel.org/stable/c/d082757b8359201c3864323cea4b91ea30a1e676 - Patch
First Time Linux
Linux linux Kernel

25 Jun 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-25 15:15

Updated : 2024-09-03 17:51

NVD link : CVE-2022-48772

Mitre link : CVE-2022-48772

CVE.ORG link : CVE-2022-48772

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference