CVE-2022-48866

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48866
In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual number of endpoints. Code should not blindly access usb_host_interface::endpoint array, since it may contain less endpoints than code expects. Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab Patch
https://git.kernel.org/stable/c/56185434e1e50acecee56d8f5850135009b87947 Patch
https://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

23 Jul 2024, 14:36

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab - () https://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab - Patch
References () https://git.kernel.org/stable/c/56185434e1e50acecee56d8f5850135009b87947 - () https://git.kernel.org/stable/c/56185434e1e50acecee56d8f5850135009b87947 - Patch
References () https://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036 - () https://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036 - Patch
CWE CWE-125
First Time Linux
Linux linux Kernel
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: HID: hid-thrustmaster: corrige la lectura OOB en Thrustmaster_interrupts Syzbot informó un error de lectura fuera de los límites en Thrustmaster_probe(). El caso raíz es la falta de verificación de validación del número real de endpoints. El código no debe acceder ciegamente a usb_host_interface::endpoint array, ya que puede contener menos endpoints de los que espera el código. Solucionelo agregando una verificación de validación faltante e imprima un error si el número de endpoints no coincide con el número esperado

16 Jul 2024, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 13:15

Updated : 2024-07-23 14:36

NVD link : CVE-2022-48866

Mitre link : CVE-2022-48866

CVE.ORG link : CVE-2022-48866

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read