CVE-2022-49551

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

usb: isp1760: Fix out-of-bounds array access

Running the driver through kasan gives an interesting splat:

BUG: KASAN: global-out-of-bounds in isp1760_register+0x180/0x70c

Read of size 20 at addr f1db2e64 by task swapper/0/1

(...)

isp1760_register from isp1760_plat_probe+0x1d8/0x220

(...)

This happens because the loop reading the regmap fields for the

different ISP1760 variants look like this:

for (i = 0; i < HC_FIELD_MAX; i++) { ... }

Meaning it expects the arrays to be at least HC_FIELD_MAX - 1 long.

However the arrays isp1760_hc_reg_fields[], isp1763_hc_reg_fields[],

isp1763_hc_volatile_ranges[] and isp1763_dc_volatile_ranges[] are

dynamically sized during compilation.

Fix this by putting an empty assignment to the [HC_FIELD_MAX]

and [DC_FIELD_MAX] array member at the end of each array.

This will make the array one member longer than it needs to be,

but avoids the risk of overwriting whatever is i

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References