usb: gadget: rndis: prevent integer overflow in rndis_set_response()
Published Jul 16, 2024
7.8
HIGHCVSS 3.1
EPSS 0.26%
Description
If "BufOffset" is very large the "BufOffset + 8" operation can have an integer overflow.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 4.14.267StatusaffectedConstraints<4.14.273
- Version 4.19.230StatusaffectedConstraints<4.19.236
- Version 4.9.302StatusaffectedConstraints<4.9.308
- Version 5.10.101StatusaffectedConstraints<5.10.108
- Version 5.15.24StatusaffectedConstraints<5.15.31
- Version 5.16.10StatusaffectedConstraints<5.16.17
- Version 5.4.180StatusaffectedConstraints<5.4.187
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| |||||||||||||||||||||||||||
| Linux | Linux | unaffected |
|
- ≥ 4.9.302 · < 4.9.308
- ≥ 4.14.267 · < 4.14.273
- ≥ 4.19.230 · < 4.19.236
- ≥ 5.4.180 · < 5.4.187
- ≥ 5.10.101 · < 5.10.108
- ≥ 5.15.24 · < 5.15.31
- ≥ 5.16.10 · < 5.16.17
No data.
Red Hat Enterprise Linux 6
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel
Out of support scope
Red Hat Enterprise Linux 7
kernel-rt
Out of support scope
Red Hat Enterprise Linux 8
kernel
Will not fix
Red Hat Enterprise Linux 8
kernel-rt
Will not fix
Red Hat Enterprise Linux 9
kernel
Will not fix
Red Hat Enterprise Linux 9
kernel-rt
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Out of support scope | n/a |
| Red Hat Enterprise Linux 8 | kernel | Will not fix | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | kernel | Will not fix | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Product Security has decided to rate this potential vulnerability as Moderate. Red Hat has protection mechanisms in place against buffer overflows, such as FORTIFY_SOURCE, Position Independent Executables or Stack Smashing Protection.
References (13)
- https://access.redhat.com/security/cve/CVE-2022-48837 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2298178 Issue Tracking
- https://git.kernel.org/stable/c/138d4f739b35dfb40438a0d5d7054965763bfbe7 Mailing ListPatch
- https://git.kernel.org/stable/c/21829376268397f9fd2c35cfa9135937b6aa3a1e Mailing ListPatch
- https://git.kernel.org/stable/c/28bc0267399f42f987916a7174e2e32f0833cc65 Mailing ListPatch
- https://git.kernel.org/stable/c/56b38e3ca4064041d93c1ca18828c8cedad2e16c Mailing ListPatch
- https://git.kernel.org/stable/c/65f3324f4b6fed78b8761c3b74615ecf0ffa81fa Mailing ListPatch
- https://git.kernel.org/stable/c/8b3e4d26bc9cd0f6373d0095b9ffd99e7da8006b Mailing ListPatch
- https://git.kernel.org/stable/c/c7953cf03a26876d676145ce5d2ae6d8c9630b90 Mailing ListPatch
- https://git.kernel.org/stable/c/df7e088d51cdf78b1a0bf1f3d405c2593295c7b0 Mailing ListPatch
- https://lore.kernel.org/linux-cve-announce/2024071621-CVE-2022-48837-9325@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2022-48837
- https://www.cve.org/CVERecord?id=CVE-2022-48837
Change history (0)
No recorded changes yet.