CVE-2022-48805

HIGH EPSS 23.3%

Published Jul 16, 20241y ago · Modified Jun 17, 20261w ago

7.8 CVSS 3.1

High

Published Jul 16, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. I have tested that this can be used by a malicious USB device to send a bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response that contains random kernel heap data. It's probably also possible to get OOB writes from this on a little-endian system somehow - maybe by triggering skb_cow() via IP options processing -, but I haven't tested that.

CVSS Details

Base Score

7.8

Exploitability

1.8

Impact

5.9

Vector string

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability High

Threat Intelligence

EPSS Exploit Probability

23.3% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-125 Out-of-bounds Read Memory Safety

Affected Products 10

Vendor	Product	Version	Range
linux	linux_kernel	*	≥3.9 – <4.9.303
linux	linux_kernel	*	≥4.10 – <4.14.268
linux	linux_kernel	*	≥4.15 – <4.19.231
linux	linux_kernel	*	≥4.20 – <5.4.180
linux	linux_kernel	*	≥5.5 – <5.10.101
linux	linux_kernel	*	≥5.11 – <5.15.24
linux	linux_kernel	*	≥5.16 – <5.16.10
linux	linux_kernel	5.17	any
linux	linux_kernel	5.17	any
linux	linux_kernel	5.17	any

References 8

git.kernel.org https://git.kernel.org/stable/c/1668781ed24da43498799aa4f65714a7de201930

Patch
git.kernel.org https://git.kernel.org/stable/c/57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581

Patch
git.kernel.org https://git.kernel.org/stable/c/63f0cfb36c1f1964a59ce544156677601e2d8740

Patch
git.kernel.org https://git.kernel.org/stable/c/711b6bf3fb052f0a6b5b3205d50e30c0c2980382

Patch
git.kernel.org https://git.kernel.org/stable/c/758290defe93a865a2880d10c5d5abd288b64b5d

Patch
git.kernel.org https://git.kernel.org/stable/c/9681823f96a811268265f35307072ad80713c274

Patch
git.kernel.org https://git.kernel.org/stable/c/a0fd5492ee769029a636f1fb521716b022b1423d

Patch
git.kernel.org https://git.kernel.org/stable/c/ffd0393adcdcefab7e131488e10dcfde5e02d6eb

Patch

Remediation

git.kernel.org https://git.kernel.org/stable/c/1668781ed24da43498799aa4f65714a7de201930

Patch
git.kernel.org https://git.kernel.org/stable/c/57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581

Patch
git.kernel.org https://git.kernel.org/stable/c/63f0cfb36c1f1964a59ce544156677601e2d8740

Patch
git.kernel.org https://git.kernel.org/stable/c/711b6bf3fb052f0a6b5b3205d50e30c0c2980382

Patch
git.kernel.org https://git.kernel.org/stable/c/758290defe93a865a2880d10c5d5abd288b64b5d

Patch
git.kernel.org https://git.kernel.org/stable/c/9681823f96a811268265f35307072ad80713c274

Patch
git.kernel.org https://git.kernel.org/stable/c/a0fd5492ee769029a636f1fb521716b022b1423d

Patch
git.kernel.org https://git.kernel.org/stable/c/ffd0393adcdcefab7e131488e10dcfde5e02d6eb

Patch