193 lines
9.7 KiB
JSON
193 lines
9.7 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.2",
|
||
"cveMetadata": {
|
||
"cveId": "CVE-2022-48927",
|
||
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"state": "PUBLISHED",
|
||
"assignerShortName": "Linux",
|
||
"dateReserved": "2024-08-21T06:06:23.298Z",
|
||
"datePublished": "2024-08-22T03:31:19.861Z",
|
||
"dateUpdated": "2026-08-05T08:52:58.053Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"providerMetadata": {
|
||
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
"shortName": "Linux",
|
||
"dateUpdated": "2026-08-05T08:52:58.053Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: tsc2046: fix memory corruption by preventing array overflow\n\nOn one side we have indio_dev->num_channels includes all physical channels +\ntimestamp channel. On other side we have an array allocated only for\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\nnum_channels variable.\n\nNote the first case is a cleanup rather than a fix as the software\ntimestamp channel bit in active_scanmask is never set by the IIO core."
|
||
}
|
||
],
|
||
"metrics": [
|
||
{
|
||
"cvssV3_1": {
|
||
"version": "3.1",
|
||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"baseScore": 7.8,
|
||
"baseSeverity": "HIGH"
|
||
},
|
||
"scenarios": [
|
||
{
|
||
"lang": "en",
|
||
"value": "AV:L - The overflow is in the TI TSC2046 SPI ADC/touchscreen IIO driver and is reached on local driver probe / subsequent local IIO buffer use, not via network or adjacent-network protocols.\nAC:L - The out-of-bounds access occurs deterministically whenever the driver probes with the vulnerable loop bound; no special race or attacker-uncontrollable state is required to hit the memory corruption.\nPR:L - Exploitation is in the context of a local unprivileged user on devices that expose this touchscreen/ADC (embedded/industrial/Android-class systems), without needing full root/init-namespace admin solely to benefit from the kernel corruption.\nUI:N - No separate victim action is required; the bad indexing runs during driver setup, and buffer enablement is performed by the attacker’s own local process.\nS:U - Impact stays within the host kernel’s authority (local memory corruption / privilege impact); it does not cross a VM, IOMMU, or other explicit security boundary.\nC:H - The bug is an out-of-bounds write/read against kernel memory (layout array overflow and read past ch_cfg into adjacent slab), which can be leveraged for information disclosure primitives under the kernel memory-corruption model.\nI:H - Out-of-bounds writes into adjacent private-state/heap (and potential undersized SPI TX/RX buffers used later) are integrity-impacting memory corruption that can support control-flow hijacking.\nA:H - Kernel out-of-bounds memory corruption in this path can oops/panic or otherwise hard-fail the kernel, so availability impact is high."
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "unaffected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/iio/adc/ti-tsc2046.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd",
|
||
"lessThan": "0cb9b2f73c182d242a640e512f4785c7c504512f",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd",
|
||
"lessThan": "082d2c047b0d305bb0b6e9f9d671a09470e2db2d",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
},
|
||
{
|
||
"version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd",
|
||
"lessThan": "b7a78a8adaa8849c02f174d707aead0f85dca0da",
|
||
"status": "affected",
|
||
"versionType": "git"
|
||
}
|
||
]
|
||
},
|
||
{
|
||
"product": "Linux",
|
||
"vendor": "Linux",
|
||
"defaultStatus": "affected",
|
||
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
||
"programFiles": [
|
||
"drivers/iio/adc/ti-tsc2046.c"
|
||
],
|
||
"versions": [
|
||
{
|
||
"version": "5.14",
|
||
"status": "affected"
|
||
},
|
||
{
|
||
"version": "0",
|
||
"lessThan": "5.14",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.15.26",
|
||
"lessThanOrEqual": "5.15.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.16.12",
|
||
"lessThanOrEqual": "5.16.*",
|
||
"status": "unaffected",
|
||
"versionType": "semver"
|
||
},
|
||
{
|
||
"version": "5.17",
|
||
"lessThanOrEqual": "*",
|
||
"status": "unaffected",
|
||
"versionType": "original_commit_for_fix"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"cpeApplicability": [
|
||
{
|
||
"nodes": [
|
||
{
|
||
"operator": "OR",
|
||
"negate": false,
|
||
"cpeMatch": [
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.14",
|
||
"versionEndExcluding": "5.15.26"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.14",
|
||
"versionEndExcluding": "5.16.12"
|
||
},
|
||
{
|
||
"vulnerable": true,
|
||
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
||
"versionStartIncluding": "5.14",
|
||
"versionEndExcluding": "5.17"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d"
|
||
},
|
||
{
|
||
"url": "https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da"
|
||
}
|
||
],
|
||
"title": "iio: adc: tsc2046: fix memory corruption by preventing array overflow",
|
||
"x_generator": {
|
||
"engine": "bippy-1.2.0"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"metrics": [
|
||
{
|
||
"other": {
|
||
"type": "ssvc",
|
||
"content": {
|
||
"id": "CVE-2022-48927",
|
||
"role": "CISA Coordinator",
|
||
"options": [
|
||
{
|
||
"Exploitation": "none"
|
||
},
|
||
{
|
||
"Automatable": "no"
|
||
},
|
||
{
|
||
"Technical Impact": "partial"
|
||
}
|
||
],
|
||
"version": "2.0.3",
|
||
"timestamp": "2024-09-10T15:33:02.652045Z"
|
||
}
|
||
}
|
||
}
|
||
],
|
||
"title": "CISA ADP Vulnrichment",
|
||
"providerMetadata": {
|
||
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
||
"shortName": "CISA-ADP",
|
||
"dateUpdated": "2024-09-12T17:33:00.502Z"
|
||
}
|
||
}
|
||
]
|
||
}
|
||
} |