CVE - CVE-2022-49051

CVE-ID
CVE-2022-49051	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup aqc111_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (desc_offset..desc_offset+2*pkt_count) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. Found doing variant analysis. Tested it with another driver (ax88179_178a), since I don't have a aqc111 device to test it, but the code looks very similar.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/36311fe98f55dea9200c69e2dd6d6ddb8fc94080 URL:https://git.kernel.org/stable/c/36311fe98f55dea9200c69e2dd6d6ddb8fc94080 MISC:https://git.kernel.org/stable/c/404998a137bcb8a926f7c949030afbe285472593 URL:https://git.kernel.org/stable/c/404998a137bcb8a926f7c949030afbe285472593 MISC:https://git.kernel.org/stable/c/afb8e246527536848b9b4025b40e613edf776a9d URL:https://git.kernel.org/stable/c/afb8e246527536848b9b4025b40e613edf776a9d MISC:https://git.kernel.org/stable/c/b416898442f2b6aa9f1b2f2968ce07e3abaa05f7 URL:https://git.kernel.org/stable/c/b416898442f2b6aa9f1b2f2968ce07e3abaa05f7 MISC:https://git.kernel.org/stable/c/d90df6da50c56ad8b1a132e3cf86b6cdf8f507b7 URL:https://git.kernel.org/stable/c/d90df6da50c56ad8b1a132e3cf86b6cdf8f507b7
Assigning CNA
kernel.org
Date Record Created
20250226	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250226)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)