HIGH
usb: gadget: uvc: Prevent buffer overflow in setup handler
Published Oct 21, 2024
7.8
HIGHCVSS 3.1
EPSS 0.27%
Description
Setup function uvc_function_setup permits control transfer requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE), data stage handler for OUT transfer uses memcpy to copy req->actual bytes to uvc_event->data.data array of size 60. This may result in an overflow of 4 bytes.
Affected products
-
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version StatusaffectedConstraints
- Version
-
- Version 2.6.35StatusaffectedConstraints-
- Version 0StatusunaffectedConstraints<2.6.35
- Version 4.14.303StatusunaffectedConstraints<=4.14.*
- Version 4.19.270StatusunaffectedConstraints<=4.19.*
- Version 4.9.337StatusunaffectedConstraints<=4.9.*
- Version 5.10.161StatusunaffectedConstraints<=5.10.*
- Version 5.15.85StatusunaffectedConstraints<=5.15.*
- Version 5.4.229StatusunaffectedConstraints<=5.4.*
- Version 6.0.15StatusunaffectedConstraints<=6.0.*
- Version 6.1.1StatusunaffectedConstraints<=6.1.*
- Version 6.2StatusunaffectedConstraints<=*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux | unaffected |
| ||||||||||||||||||||||||||||||||||||
| Linux | Linux | affected |
|
OR
- ≥ 2.6.35 · < 4.9.337
- ≥ 4.10 · < 4.14.303
- ≥ 4.15 · < 4.19.270
- ≥ 4.20 · < 5.4.229
- ≥ 5.5 · < 5.10.161
- ≥ 5.11 · < 5.15.85
- ≥ 5.16 · < 6.0.15
- 6.1
No data.
Red Hat Enterprise Linux 6
kernel
Not affected
Red Hat Enterprise Linux 7
kernel
Not affected
Red Hat Enterprise Linux 7
kernel-rt
Not affected
Red Hat Enterprise Linux 8
kernel
Not affected
Red Hat Enterprise Linux 8
kernel-rt
Not affected
Red Hat Enterprise Linux 9
kernel
Not affected
Red Hat Enterprise Linux 9
kernel-rt
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel | Not affected | n/a |
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (15)
- https://access.redhat.com/security/cve/CVE-2022-48948 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2320677 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-53827 Advisory
- https://git.kernel.org/stable/c/06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5 Patch
- https://git.kernel.org/stable/c/4972e3528b968665b596b5434764ff8fd9446d35 Patch
- https://git.kernel.org/stable/c/4c92670b16727365699fe4b19ed32013bab2c107 Patch
- https://git.kernel.org/stable/c/6b41a35b41f77821db24f2d8f66794b390a585c5 Patch
- https://git.kernel.org/stable/c/7b1f773277a72f9756d47a41b94e43506cce1954 Patch
- https://git.kernel.org/stable/c/b8fb1cba934ea122b50f13a4f9d6fc4fdc43d2be Patch
- https://git.kernel.org/stable/c/bc8380fe5768c564f921f7b4eaba932e330b9e4b Patch
- https://git.kernel.org/stable/c/c79538f32df12887f110dcd6b9c825b482905f24 Patch
- https://git.kernel.org/stable/c/d1a92bb8d697f170d93fe922da763d7d156b8841 Patch
- https://lore.kernel.org/linux-cve-announce/2024102140-CVE-2022-48948-588a@gregkh/T
- https://nvd.nist.gov/vuln/detail/CVE-2022-48948
- https://www.cve.org/CVERecord?id=CVE-2022-48948
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published Oct 21, 2024
Updated May 11, 2026
Reserved Aug 22, 2024
Link CVE-2022-48948
CISA Vulnrichment
Updated Oct 22, 2024
ENISA EUVD
EUVD-2022-53827 Assigner Linux
Published Oct 21, 2024
Updated May 11, 2026
Exploited since n/a
Link EUVD-2022-53827