CVE-2022-49551

usb: isp1760: Fix out-of-bounds array access

High · published February 26, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

usb: isp1760: Fix out-of-bounds array access

Running the driver through kasan gives an interesting splat:

BUG: KASAN: global-out-of-bounds in isp1760_register+0x180/0x70c

Read of size 20 at addr f1db2e64 by task swapper/0/1

(...)

isp1760_register from isp1760_plat_probe+0x1d8/0x220

(...)

This happens because the loop reading the regmap fields for the

different ISP1760 variants look like this:

for (i = 0; i < HC_FIELD_MAX; i++) { ... }

Meaning it expects the arrays to be at least HC_FIELD_MAX - 1 long.

However the arrays isp1760_hc_reg_fields[], isp1763_hc_reg_fields[],

isp1763_hc_volatile_ranges[] and isp1763_dc_volatile_ranges[] are

dynamically sized during compilation.

Fix this by putting an empty assignment to the [HC_FIELD_MAX]

and [DC_FIELD_MAX] array member at the end of each array.

This will make the array one member longer than it needs to be,

but avoids the risk of overwriting whatever is inside

[HC_FIELD_MAX - 1] and is simple and intuitive to read. Also

add comments explaining what is going on.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Published
2025-02-26T02:14Z
EPSS history
Timeline
  • 26 FEB 02:14Z
    usb: isp1760: Fix out-of-bounds array access
    cvelistv5