In the Linux kernel, the following vulnerability has been resolved:
of: fdt: fix off-by-one error in unflattendtnodes()
Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflattendtnodes() which makes it possible to overflow the nps[] buffer...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
[
{
"id": "CVE-2022-48672-15902b57",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f945a792f67815abca26fa8a5e863ccf3fa1181",
"digest": {
"length": 934.0,
"function_hash": "203729082787973387573487389213773606325"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "unflatten_dt_nodes",
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-302cbc27",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba6b9f7cc1108bad6e2c53b1d6e0156379188db7",
"digest": {
"line_hashes": [
"138072565979436978034464704487286801475",
"225940363556996543206384134113636449954",
"48634598102954371315622601209415051233",
"151647182632553299584254921600014984537"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-3c6cf628",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0e88c25f88b9805572263c9ed20f1d88742feaf",
"digest": {
"line_hashes": [
"138072565979436978034464704487286801475",
"225940363556996543206384134113636449954",
"48634598102954371315622601209415051233",
"151647182632553299584254921600014984537"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-4a218f66",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2133f451311671c7c42b5640d2b999326b39aa0e",
"digest": {
"length": 934.0,
"function_hash": "203729082787973387573487389213773606325"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "unflatten_dt_nodes",
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-5abd95eb",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f945a792f67815abca26fa8a5e863ccf3fa1181",
"digest": {
"line_hashes": [
"138072565979436978034464704487286801475",
"225940363556996543206384134113636449954",
"48634598102954371315622601209415051233",
"151647182632553299584254921600014984537"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-667f0bee",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2133f451311671c7c42b5640d2b999326b39aa0e",
"digest": {
"line_hashes": [
"138072565979436978034464704487286801475",
"225940363556996543206384134113636449954",
"48634598102954371315622601209415051233",
"151647182632553299584254921600014984537"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-8a5984dc",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2566706ac6393386a4e7c4ce23fe17f4c98d9aa0",
"digest": {
"length": 916.0,
"function_hash": "110145490211423525438889095444115527338"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "unflatten_dt_nodes",
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-9689b567",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e0e88c25f88b9805572263c9ed20f1d88742feaf",
"digest": {
"length": 916.0,
"function_hash": "110145490211423525438889095444115527338"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "unflatten_dt_nodes",
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-a018ea2b",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4369260e77821602102dcc7d792de39a56365c",
"digest": {
"length": 916.0,
"function_hash": "110145490211423525438889095444115527338"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "unflatten_dt_nodes",
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-abb7fdb5",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbdda20ce363356698835185801a58a28f644853",
"digest": {
"line_hashes": [
"138072565979436978034464704487286801475",
"225940363556996543206384134113636449954",
"228257787224560978116371562083631638543",
"82937864139822610577417225526288875625"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-cd8f0069",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2566706ac6393386a4e7c4ce23fe17f4c98d9aa0",
"digest": {
"line_hashes": [
"138072565979436978034464704487286801475",
"225940363556996543206384134113636449954",
"48634598102954371315622601209415051233",
"151647182632553299584254921600014984537"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-d2229b2c",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ba6b9f7cc1108bad6e2c53b1d6e0156379188db7",
"digest": {
"length": 934.0,
"function_hash": "203729082787973387573487389213773606325"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "unflatten_dt_nodes",
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-e3a00693",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee4369260e77821602102dcc7d792de39a56365c",
"digest": {
"line_hashes": [
"138072565979436978034464704487286801475",
"225940363556996543206384134113636449954",
"48634598102954371315622601209415051233",
"151647182632553299584254921600014984537"
],
"threshold": 0.9
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"target": {
"file": "drivers/of/fdt.c"
}
},
{
"id": "CVE-2022-48672-f5d8c082",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cbdda20ce363356698835185801a58a28f644853",
"digest": {
"length": 987.0,
"function_hash": "268142916560906031072611122901344770264"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"target": {
"function": "unflatten_dt_nodes",
"file": "drivers/of/fdt.c"
}
}
]