5.5

CVE-2022-49790

Input: iforce - invert valid length check when fetching device IDs

In the Linux kernel, the following vulnerability has been resolved:

Input: iforce - invert valid length check when fetching device IDs

syzbot is reporting uninitialized value at iforce_init_device() [1], for
commit 6ac0aec6b0a6 ("Input: iforce - allow callers supply data buffer
when fetching device IDs") is checking that valid length is shorter than
bytes to read. Since iforce_get_id_packet() stores valid length when
returning 0, the caller needs to check that valid length is longer than or
equals to bytes to read.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 5.3 < 5.4.225
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.156
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.80
Linux ≫ Linux Kernel Version >= 5.16 < 6.0.10
Linux ≫ Linux Kernel Version6.1 Updaterc1
Linux ≫ Linux Kernel Version6.1 Updaterc2
Linux ≫ Linux Kernel Version6.1 Updaterc3
Linux ≫ Linux Kernel Version6.1 Updaterc4
Linux ≫ Linux Kernel Version6.1 Updaterc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.17% 0.061
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-908 Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

https://git.kernel.org/stable/c/5d53797ce7ce8fb1d95a5bebc5efa9418c4217a3
Patch
https://git.kernel.org/stable/c/24cc679abbf31477d0cc6106ec83c2fbae6b3cdf
Patch
https://git.kernel.org/stable/c/fdd57c20d4408cac3c3c535c120d244e083406c9
Patch
https://git.kernel.org/stable/c/6365569d62a75ddf53fb0c2936c16587a365984c
Patch
https://git.kernel.org/stable/c/b8ebf250997c5fb253582f42bfe98673801ebebd
Patch