CVE-2022-48805: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
First published: Tue Jul 16 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. I have tested that this can be used by a malicious USB device to send a bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response that contains random kernel heap data. It's probably also possible to get OOB writes from this on a little-endian system somehow - maybe by triggering skb_cow() via IP options processing -, but I haven't tested that.
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Kernel-devel | ||
| >=3.9<4.9.303 | ||
| >=4.10<4.14.268 | ||
| >=4.15<4.19.231 | ||
| >=4.20<5.4.180 | ||
| >=5.5<5.10.101 | ||
| >=5.11<5.15.24 | ||
| >=5.16<5.16.10 | ||
| =5.17-rc1 | ||
| =5.17-rc2 | ||
| =5.17-rc3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/711b6bf3fb052f0a6b5b3205d50e30c0c2980382
- https://git.kernel.org/stable/c/63f0cfb36c1f1964a59ce544156677601e2d8740
- https://git.kernel.org/stable/c/1668781ed24da43498799aa4f65714a7de201930
- https://git.kernel.org/stable/c/a0fd5492ee769029a636f1fb521716b022b1423d
- https://git.kernel.org/stable/c/758290defe93a865a2880d10c5d5abd288b64b5d
- https://git.kernel.org/stable/c/ffd0393adcdcefab7e131488e10dcfde5e02d6eb
- https://git.kernel.org/stable/c/9681823f96a811268265f35307072ad80713c274
- https://git.kernel.org/stable/c/57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581
Frequently Asked Questions
What is the severity of CVE-2022-48805?
CVE-2022-48805 is rated as a medium severity vulnerability due to potential out-of-bounds accesses in the Linux kernel.
How do I fix CVE-2022-48805?
To resolve CVE-2022-48805, upgrade to the latest version of the Linux kernel that includes the security fixes.
What systems are affected by CVE-2022-48805?
CVE-2022-48805 affects systems running the Linux kernel that utilize the ax88179_178a USB driver.
What are the risks associated with CVE-2022-48805?
Exploitation of CVE-2022-48805 could lead to denial of service or other unintended behavior due to out-of-bounds memory accesses.
Who reported CVE-2022-48805?
CVE-2022-48805 was reported as a vulnerability by security researchers analyzing the Linux kernel.
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/remedy
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- vendor/linux
- canonical/red hat kernel-devel