CVE-2022-48806

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-48806

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

I

n the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once. In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the length to read as an u8. If count == 256 after taking into account the offset and page boundary, the cast to u8 overflows. And this is common when user space tries to read the entire EEPROM at once. To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.

References
Link Resource
https://git.kernel.org/stable/c/3937c35493ee2847aaefcfa5460e94b7443eef49 Patch
https://git.kernel.org/stable/c/9443ddeb3754e9e382a396b50adc1961301713ce Patch
https://git.kernel.org/stable/c/9a5f471ae380f9fcb9756d453c12ca1f8595a93c Patch
https://git.kernel.org/stable/c/a37960df7eac3cc8094bd1ab84864e9e32c91345 Patch
https://git.kernel.org/stable/c/c0689e46be23160d925dca95dfc411f1a0462708 Patch
https://git.kernel.org/stable/c/3937c35493ee2847aaefcfa5460e94b7443eef49 Patch
https://git.kernel.org/stable/c/9443ddeb3754e9e382a396b50adc1961301713ce Patch
https://git.kernel.org/stable/c/9a5f471ae380f9fcb9756d453c12ca1f8595a93c Patch
https://git.kernel.org/stable/c/a37960df7eac3cc8094bd1ab84864e9e32c91345 Patch
https://git.kernel.org/stable/c/c0689e46be23160d925dca95dfc411f1a0462708 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
History

03 Oct 2025, 14:17

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/3937c35493ee2847aaefcfa5460e94b7443eef49 - () https://git.kernel.org/stable/c/3937c35493ee2847aaefcfa5460e94b7443eef49 - Patch
References () https://git.kernel.org/stable/c/9443ddeb3754e9e382a396b50adc1961301713ce - () https://git.kernel.org/stable/c/9443ddeb3754e9e382a396b50adc1961301713ce - Patch
References () https://git.kernel.org/stable/c/9a5f471ae380f9fcb9756d453c12ca1f8595a93c - () https://git.kernel.org/stable/c/9a5f471ae380f9fcb9756d453c12ca1f8595a93c - Patch
References () https://git.kernel.org/stable/c/a37960df7eac3cc8094bd1ab84864e9e32c91345 - () https://git.kernel.org/stable/c/a37960df7eac3cc8094bd1ab84864e9e32c91345 - Patch
References () https://git.kernel.org/stable/c/c0689e46be23160d925dca95dfc411f1a0462708 - () https://git.kernel.org/stable/c/c0689e46be23160d925dca95dfc411f1a0462708 - Patch
CPE cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux linux Kernel
Linux
CWE CWE-190

21 Nov 2024, 07:34

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se resolvió la siguiente vulnerabilidad: eeprom: ee1004: limitar las lecturas de i2c a I2C_SMBUS_BLOCK_MAX El commit effa453168a7 ("i2c: i801: No corrija silenciosamente el tamaño de transferencia no válido") reveló que ee1004_eeprom_read() no limitaba adecuadamente cuántas bytes para leer a la vez. En particular, i2c_smbus_read_i2c_block_data_or_emulated() toma la longitud para leer como u8. Si el recuento == 256 después de tener en cuenta el desplazamiento y el límite de la página, la conversión a u8 se desborda. Y esto es común cuando el espacio del usuario intenta leer toda la EEPROM a la vez. Para solucionarlo, limite cada lectura a I2C_SMBUS_BLOCK_MAX (32) bytes, ya que la longitud máxima que permite i2c_smbus_read_i2c_block_data_or_emulated().
References () https://git.kernel.org/stable/c/3937c35493ee2847aaefcfa5460e94b7443eef49 - () https://git.kernel.org/stable/c/3937c35493ee2847aaefcfa5460e94b7443eef49 -
References () https://git.kernel.org/stable/c/9443ddeb3754e9e382a396b50adc1961301713ce - () https://git.kernel.org/stable/c/9443ddeb3754e9e382a396b50adc1961301713ce -
References () https://git.kernel.org/stable/c/9a5f471ae380f9fcb9756d453c12ca1f8595a93c - () https://git.kernel.org/stable/c/9a5f471ae380f9fcb9756d453c12ca1f8595a93c -
References () https://git.kernel.org/stable/c/a37960df7eac3cc8094bd1ab84864e9e32c91345 - () https://git.kernel.org/stable/c/a37960df7eac3cc8094bd1ab84864e9e32c91345 -
References () https://git.kernel.org/stable/c/c0689e46be23160d925dca95dfc411f1a0462708 - () https://git.kernel.org/stable/c/c0689e46be23160d925dca95dfc411f1a0462708 -

16 Jul 2024, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-16 12:15

Updated : 2025-10-03 14:17

NVD link : CVE-2022-48806

Mitre link : CVE-2022-48806

CVE.ORG link : CVE-2022-48806

JSON object : View

Products Affected

linux

CWE
CWE-190

Integer Overflow or Wraparound