CVE-2022-48866: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
First published: Tue Jul 16 2024(Updated: )
In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual number of endpoints. Code should not blindly access usb_host_interface::endpoint array, since it may contain less endpoints than code expects. Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number
Credit: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/kernel | <5.15.29 | 5.15.29 |
| redhat/kernel | <5.16.15 | 5.16.15 |
| redhat/kernel | <5.17 | 5.17 |
| Linux Kernel | >=5.13<5.15.29 | |
| Linux Kernel | >=5.16<5.16.15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/stable/c/3ffbe85cda7f523dad896bae08cecd8db8b555ab
- https://git.kernel.org/stable/c/56185434e1e50acecee56d8f5850135009b87947
- https://git.kernel.org/stable/c/fc3ef2e3297b3c0e2006b5d7b3d66965e3392036
- https://access.redhat.com/errata/RHSA-2024:7001
- https://access.redhat.com/errata/RHSA-2024:7000
- https://bugzilla.redhat.com/show_bug.cgi?id=2298640
Frequently Asked Questions
What is the severity of CVE-2022-48866?
The severity of CVE-2022-48866 is classified as moderate due to the potential for an out-of-bounds read affecting kernel memory.
How do I fix CVE-2022-48866?
To fix CVE-2022-48866, upgrade your Linux kernel to version 5.15.29, 5.16.15, or 5.17 or later.
What systems are affected by CVE-2022-48866?
CVE-2022-48866 affects Linux kernel versions between 5.13 and 5.15.29, and includes specific versions 5.16.15 and 5.17.
What type of vulnerability is CVE-2022-48866?
CVE-2022-48866 is an out-of-bounds read vulnerability in the Linux kernel's HID subsystem.
Who reported the issue for CVE-2022-48866?
The issue for CVE-2022-48866 was reported by Syzbot, which is a tool designed to detect kernel vulnerabilities.
- agent/title
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- agent/weakness
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/description
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-48866
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/linux
- canonical/linux kernel
- version/linux kernel/5.13
- version/linux kernel/5.16