CVE-2022-49507

MEDIUM EPSS 14.9%
Published Feb 26, 20251y ago · Modified Jun 17, 20261w ago
5.5 CVSS 3.1
Medium
Find Similar
Published Feb 26, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: regulator: da9121: Fix uninit-value in da9121_assign_chip_model() KASAN report slab-out-of-bounds in __regmap_init as follows: BUG: KASAN: slab-out-of-bounds in __regmap_init drivers/base/regmap/regmap.c:841 Read of size 1 at addr ffff88803678cdf1 by task xrun/9137 CPU: 0 PID: 9137 Comm: xrun Tainted: G W 5.18.0-rc2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xe8/0x15a lib/dump_stack.c:88 print_report.cold+0xcd/0x69b mm/kasan/report.c:313 kasan_report+0x8e/0xc0 mm/kasan/report.c:491 __regmap_init+0x4540/0x4ba0 drivers/base/regmap/regmap.c:841 __devm_regmap_init+0x7a/0x100 drivers/base/regmap/regmap.c:1266 __devm_regmap_init_i2c+0x65/0x80 drivers/base/regmap/regmap-i2c.c:394 da9121_i2c_probe+0x386/0x6d1 drivers/regulator/da9121-regulator.c:1039 i2c_device_probe+0x959/0xac0 drivers/i2c/i2c-core-base.c:563 This happend when da9121 device is probe by da9121_i2c_id, but with invalid dts. Thus, chip->subvariant_id is set to -EINVAL, and later da9121_assign_chip_model() will access 'regmap' without init it. Fix it by return -EINVAL from da9121_assign_chip_model() if 'chip->subvariant_id' is invalid.

CVSS Details

Base Score
5.5
Exploitability
1.8
Impact
3.6
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
14.9% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-908

Affected Products 3

VendorProductVersionRange
linuxlinux_kernel*≥5.11  –  <5.15.46
linuxlinux_kernel*≥5.16  –  <5.17.14
linuxlinux_kernel*≥5.18  –  <5.18.3

References 4

  • git.kernel.org https://git.kernel.org/stable/c/60f21eda69f1b5727a97d2077da766eb27fcc21f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7da64c7c82c9b29b628a62c88a8c2fb06990563d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bab76514aca36bc513224525d5598da676938218
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/be96baa0c79588084e0d7a4fa21c574cec9a57f4
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/60f21eda69f1b5727a97d2077da766eb27fcc21f
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/7da64c7c82c9b29b628a62c88a8c2fb06990563d
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/bab76514aca36bc513224525d5598da676938218
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/be96baa0c79588084e0d7a4fa21c574cec9a57f4
    Patch