5.5

CVE-2022-48806

eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX

In the Linux kernel, the following vulnerability has been resolved:

eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX

Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer
size") revealed that ee1004_eeprom_read() did not properly limit how
many bytes to read at once.

In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the
length to read as an u8.  If count == 256 after taking into account the
offset and page boundary, the cast to u8 overflows.  And this is common
when user space tries to read the entire EEPROM at once.

To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already
the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 4.4.300 < 4.5
Linux ≫ Linux Kernel Version >= 4.9.298 < 4.10
Linux ≫ Linux Kernel Version >= 4.14.263 < 4.15
Linux ≫ Linux Kernel Version >= 4.19.226 < 4.20
Linux ≫ Linux Kernel Version >= 5.4.174 < 5.4.180
Linux ≫ Linux Kernel Version >= 5.10.94 < 5.10.101
Linux ≫ Linux Kernel Version >= 5.15.17 < 5.15.24
Linux ≫ Linux Kernel Version >= 5.16.3 < 5.16.10
Linux ≫ Linux Kernel Version5.17 Updaterc1
Linux ≫ Linux Kernel Version5.17 Updaterc2
Linux ≫ Linux Kernel Version5.17 Updaterc3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.28% 0.196
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://git.kernel.org/stable/c/3937c35493ee2847aaefcfa5460e94b7443eef49
Patch
https://git.kernel.org/stable/c/9443ddeb3754e9e382a396b50adc1961301713ce
Patch
https://git.kernel.org/stable/c/9a5f471ae380f9fcb9756d453c12ca1f8595a93c
Patch
https://git.kernel.org/stable/c/a37960df7eac3cc8094bd1ab84864e9e32c91345
Patch
https://git.kernel.org/stable/c/c0689e46be23160d925dca95dfc411f1a0462708
Patch