CVE-2022-48938: CDC-NCM: avoid overflow in sanity checking
In the Linux kernel, the following vulnerability has been resolved:
CDC-NCM: avoid overflow in sanity checking
A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48938?
CVE-2022-48938 has a medium severity level due to its potential for causing integer overflow vulnerabilities.
How do I fix CVE-2022-48938?
To fix CVE-2022-48938, you should update the Linux kernel to the recommended versions such as 5.10.223-1 or higher.
What are the affected software versions for CVE-2022-48938?
CVE-2022-48938 affects various Linux kernel versions, primarily those before 5.10.103 and between 5.11 and 5.15.26.
How is CVE-2022-48938 exploited?
CVE-2022-48938 can be exploited through a broken device that provides extreme offsets during data transmission, leading to integer overflow.
Is CVE-2022-48938 fixed in the latest kernel releases?
Yes, CVE-2022-48938 has been resolved in recent Linux kernel releases such as 6.12.10-1.