CVE-2022-48871

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48871
In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer.

7.1 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.2

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a Patch
https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2 Patch
https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a Patch
https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

06 Sep 2024, 14:23

Type Values Removed Values Added
CWE CWE-125
First Time Linux linux Kernel
Linux
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a - () https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a - Patch
References () https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2 - () https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2 - Patch
References () https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a - () https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a - Patch
References () https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95 - () https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95 - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.1
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: serial: qcom-geni-serial: corrige los límites fuera de los límites en el búfer RX FIFO La sonda del controlador asigna memoria para RX FIFO (puerto->rx_fifo) según el valor predeterminado Profundidad FIFO de RX, por ejemplo, 16. Más adelante, durante el inicio en serie, qcom_geni_serial_port_setup() actualiza la profundidad FIFO de RX (puerto->rx_fifo_profundidad) para que coincida con las capacidades reales del dispositivo, por ejemplo, a 32. El código de identificador de RX UART leerá el número "puerto->rx_fifo_profundidad" de palabras en el búfer "port->rx_fifo", excediendo así los límites. Esto se puede observar en ciertas configuraciones con el dispositivo Qualcomm Bluetooth HCI UART y KASAN: Bluetooth: hci0: QCA ID de producto: 0x00000010 Bluetooth: hci0: QCA SOC Version: 0x400a0200 Bluetooth: hci0: QCA ROM Version: 0x00000200 Bluetooth: hci0: QCA Patch Version :0x00000d2b Bluetooth: hci0: versión del controlador QCA 0x02000200 Bluetooth: hci0: QCA Descargando qca/htbtfw20.tlv bluetooth hci0: La carga directa del firmware para qca/htbtfw20.tlv falló con el error -2 Bluetooth: hci0: QCA No se pudo solicitar el archivo: qca/ htbtfw20.tlv (-2) Bluetooth: hci0: QCA Error al descargar el parche (-2) =============================== ==================================== ERROR: KASAN: losa fuera de los límites en handle_rx_uart+ 0xa8/0x18c Escritura de tamaño 4 en la dirección ffff279347d578c0 mediante task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Nombre de hardware: Qualcomm Technologies, Inc Robótica RB5 (DT) Seguimiento de llamadas: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa. 8/0x18c qcom_geni_serial_handle_rx+ 0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 Si la profundidad FIFO de RX cambia después sonda, asegúrese de cambiar el tamaño del búfer.

21 Aug 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-21 07:15

Updated : 2024-09-06 14:23

NVD link : CVE-2022-48871

Mitre link : CVE-2022-48871

CVE.ORG link : CVE-2022-48871

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-125

Out-of-bounds Read