CVE - CVE-2022-48805

CVE-ID
CVE-2022-48805	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. I have tested that this can be used by a malicious USB device to send a bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response that contains random kernel heap data. It's probably also possible to get OOB writes from this on a little-endian system somehow - maybe by triggering skb_cow() via IP options processing -, but I haven't tested that.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/1668781ed24da43498799aa4f65714a7de201930 URL:https://git.kernel.org/stable/c/1668781ed24da43498799aa4f65714a7de201930 MISC:https://git.kernel.org/stable/c/57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581 URL:https://git.kernel.org/stable/c/57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581 MISC:https://git.kernel.org/stable/c/63f0cfb36c1f1964a59ce544156677601e2d8740 URL:https://git.kernel.org/stable/c/63f0cfb36c1f1964a59ce544156677601e2d8740 MISC:https://git.kernel.org/stable/c/711b6bf3fb052f0a6b5b3205d50e30c0c2980382 URL:https://git.kernel.org/stable/c/711b6bf3fb052f0a6b5b3205d50e30c0c2980382 MISC:https://git.kernel.org/stable/c/758290defe93a865a2880d10c5d5abd288b64b5d URL:https://git.kernel.org/stable/c/758290defe93a865a2880d10c5d5abd288b64b5d MISC:https://git.kernel.org/stable/c/9681823f96a811268265f35307072ad80713c274 URL:https://git.kernel.org/stable/c/9681823f96a811268265f35307072ad80713c274 MISC:https://git.kernel.org/stable/c/a0fd5492ee769029a636f1fb521716b022b1423d URL:https://git.kernel.org/stable/c/a0fd5492ee769029a636f1fb521716b022b1423d MISC:https://git.kernel.org/stable/c/ffd0393adcdcefab7e131488e10dcfde5e02d6eb URL:https://git.kernel.org/stable/c/ffd0393adcdcefab7e131488e10dcfde5e02d6eb
Assigning CNA
kernel.org
Date Record Created
20240716	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240716)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)