CVE-2022-49790

Input: iforce - invert valid length check when fetching device IDs

published May 1, 2025

CVSS
—
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

Input: iforce - invert valid length check when fetching device IDs

syzbot is reporting uninitialized value at iforce_init_device() [1], for

commit 6ac0aec6b0a6 ("Input: iforce - allow callers supply data buffer

when fetching device IDs") is checking that valid length is shorter than

bytes to read. Since iforce_get_id_packet() stores valid length when

returning 0, the caller needs to check that valid length is longer than or

equals to bytes to read.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Published
2025-05-01T14:09Z
EPSS history
Timeline
  • 01 MAY 14:09Z
    Input: iforce - invert valid length check when fetching device IDs
    cvelistv5