CVE-2022-49051: net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
In the Linux kernel, the following vulnerability has been resolved:
net: usb: aqc111: Fix out-of-bounds accesses in RX fixup
aqc111rxfixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular:
- The metadata array (descoffset..descoffset+2pktcount) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data.
Found doing variant analysis. Tested it with another driver (ax88179178a), since I don't have a aqc111 device to test it, but the code looks very similar.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
If you are not able to patch immediately, mitigate exploitation by preventing untrusted/unknown USB Ethernet devices from being connected (e.g., block/deny access at the host level or network edge) since this bug is triggered by a malicious or defective USB device handed to the network stack.
Event History
Frequently Asked Questions
What is the severity of CVE-2022-49051?
CVE-2022-49051 has been classified as a medium severity vulnerability due to its potential to cause out-of-bounds memory accesses.
How do I fix CVE-2022-49051?
To fix CVE-2022-49051, update your Linux kernel to the latest patched version that addresses this vulnerability.
What systems are affected by CVE-2022-49051?
CVE-2022-49051 affects the Linux kernel specifically when interacting with certain USB devices that can cause out-of-bounds memory access.
What are the consequences of CVE-2022-49051?
If exploited, CVE-2022-49051 could lead to system crashes or arbitrary code execution from a malicious USB device.
Is CVE-2022-49051 being actively exploited?
As of now, there is no public indication that CVE-2022-49051 is actively being exploited, but it is essential to patch the vulnerability to mitigate risk.