CVE - CVE-2022-49032

CVE-ID
CVE-2022-49032	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fix oob read in afe4404_[read\|write]_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278 Call Trace: afe4404_read_raw iio_read_channel_info dev_attr_show The buggy address belongs to the variable: afe4404_channel_leds+0x18/0xffffffffffffe9c0 This issue can be reproduce by singe command: $ cat /sys/bus/i2c/devices/0-0058/iio\:device0/in_intensity6_raw The array size of afe4404_channel_leds and afe4404_channel_offdacs are less than channels, so access with chan->address cause OOB read in afe4404_[read\|write]_raw. Fix it by moving access before use them.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/113c08030a89aaf406f8a1d4549d758a67c2afba URL:https://git.kernel.org/stable/c/113c08030a89aaf406f8a1d4549d758a67c2afba MISC:https://git.kernel.org/stable/c/3f566b626029ca8598d48e5074e56bb37399ca1b URL:https://git.kernel.org/stable/c/3f566b626029ca8598d48e5074e56bb37399ca1b MISC:https://git.kernel.org/stable/c/5eb114f55b37dbc0487aa9c1913b81bb7837f1c4 URL:https://git.kernel.org/stable/c/5eb114f55b37dbc0487aa9c1913b81bb7837f1c4 MISC:https://git.kernel.org/stable/c/68de7da092f38395dde523f2e5db26eba6c23e28 URL:https://git.kernel.org/stable/c/68de7da092f38395dde523f2e5db26eba6c23e28 MISC:https://git.kernel.org/stable/c/d45d9f45e7b1365fd0d9bf14680d6d5082a590d1 URL:https://git.kernel.org/stable/c/d45d9f45e7b1365fd0d9bf14680d6d5082a590d1 MISC:https://git.kernel.org/stable/c/f5575041ec15310bdc50c42b8b22118cc900226e URL:https://git.kernel.org/stable/c/f5575041ec15310bdc50c42b8b22118cc900226e MISC:https://git.kernel.org/stable/c/f7419fc42afc035f6b29ce713e17dcd2000c833f URL:https://git.kernel.org/stable/c/f7419fc42afc035f6b29ce713e17dcd2000c833f MISC:https://git.kernel.org/stable/c/fc92d9e3de0b2d30a3ccc08048a5fad533e4672b URL:https://git.kernel.org/stable/c/fc92d9e3de0b2d30a3ccc08048a5fad533e4672b
Assigning CNA
kernel.org
Date Record Created
20240822	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240822)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)