CVE-2022-48632CWE-787

CVE-2022-48632

High · published April 28, 2024

CVSS v3.1
7.8
EPSS
0%
Percentile
16.2
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()

memcpy() is called in a loop while 'operation->length' upper bound

is not checked and 'data_idx' also increments.

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00255 · 16.2th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2024-04-28T17:15Z
Affected products (9)
ProductVersionsFixed in
linux/linux_kernel≥ 5.10, < 5.10.1465.10.146
linux/linux_kernel≥ 5.11, < 5.15.715.15.71
linux/linux_kernel≥ 5.16, < 5.19.125.19.12
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
References (8)
https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2 · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b · 416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2 · af854a3a-2127-422b-91ae-364da2661108https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 28 APR 12:59Z
    i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
    cvelistv5