CVE-2022-48871 — tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

Back Back to CVE browser

HIGH

tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

Published Aug 21, 2024

8.8

HIGH

CVSS 3.1

EPSS 0.35%

Description

Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32.

The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN:

Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64

If the RX FIFO depth changes after probe, be sure to resize the buffer.

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.7
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.7
- Version
  5.10.165
  Status
  unaffected
  Constraints
  <=5.10.*
- Version
  5.15.90
  Status
  unaffected
  Constraints
  <=5.15.*
- Version
  6.1.8
  Status
  unaffected
  Constraints
  <=6.1.*
- Version
  6.2
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.7	affected	-
0	unaffected	<5.7
5.10.165	unaffected	<=5.10.*
5.15.90	unaffected	<=5.15.*
6.1.8	unaffected	<=6.1.*
6.2	unaffected	<=*

Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Not affected
Red Hat Enterprise Linux 8

kernel-rt

Not affected
Red Hat Enterprise Linux 9

kernel

Not affected
Red Hat Enterprise Linux 9

kernel-rt

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Not affected	n/a
Red Hat Enterprise Linux 8	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 9	kernel	Not affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Not affected	n/a

Remediation

Red Hat statement

Red Hat Enterprise Linux is not impacted by this CVE, as this vulnerability does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue and no further action or mitigation is necessary for systems running this operating system.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

0.35% 0.00349

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 2, 2026.

EPSS probability 0.00349

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 2, 2026	0.35% (0.00349)	26.14th	v5 (v2026.06.15)
Jun 15, 2026	0.25% (0.00248)	15.76th	v5 (v2026.06.15)
Mar 17, 2025	0.03% (0.00030)	5.41th	v4 (v2025.03.14)
Dec 12, 2024	0.04% (0.00042)	5.07th	v3 (v2023.03.01)
Aug 22, 2024	0.04% (0.00045)	16.38th	v3 (v2023.03.01)

Weaknesses (2)

CWE-125

Out-of-bounds Read

CWE-787

Out-of-bounds Write

References (9)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2022-48871		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2306392		Issue Tracking
https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a		Patch
https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2		Patch
https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a		Patch
https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95		Patch
https://lore.kernel.org/linux-cve-announce/2024082105-CVE-2022-48871-93c2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2022-48871
https://www.cve.org/CVERecord?id=CVE-2022-48871