In the Linux kernel, the following vulnerability has been resolved:
vtioctl: fix arrayindexnospec in vtsetactivate
arrayindexnospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console should be decreased first and then sanitized with arrayindexnospec.
Kasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU Amsterdam.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61cc70d9e8ef5b042d4ed87994d20100ec8896d9",
"id": "CVE-2022-48804-0b03745d",
"signature_version": "v1",
"target": {
"function": "vt_setactivate",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "288227640720784180658326713425846504175",
"length": 640.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@830c5aa302ec16b4ee641aec769462c37f802c90",
"id": "CVE-2022-48804-0c755806",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150627071650387170602505094128075624183",
"148962025589324305982614510223918655814",
"310389737191671291144020893713946995782",
"126166670823020513162988840910386197258",
"68723916664151648144165261924466237363",
"104620998461786202132591034497804741473"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a45a6bd1e6d651770aafff57ab3e1d3bb0b42e0",
"id": "CVE-2022-48804-365adb00",
"signature_version": "v1",
"target": {
"function": "vt_ioctl",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "53546674085811856208914555801724782184",
"length": 9997.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@778302ca09498b448620edd372dc908bebf80bdf",
"id": "CVE-2022-48804-36c24498",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25389570997047978881192280726664814829",
"169426037697968425534617089563042360433",
"188095013029745694322608387398402163192",
"204540090591062794080741455828721472183",
"322435694204517763222105681151028659939"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@830c5aa302ec16b4ee641aec769462c37f802c90",
"id": "CVE-2022-48804-3f0fdd06",
"signature_version": "v1",
"target": {
"function": "vt_ioctl",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "53546674085811856208914555801724782184",
"length": 9997.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffe54289b02e9c732d6f04c8ebbe3b2d90d32118",
"id": "CVE-2022-48804-4f61ac9e",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25389570997047978881192280726664814829",
"169426037697968425534617089563042360433",
"188095013029745694322608387398402163192",
"204540090591062794080741455828721472183",
"322435694204517763222105681151028659939"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6550bdf52846f85a2a3726a5aa0c7c4399f2fc02",
"id": "CVE-2022-48804-67d260a8",
"signature_version": "v1",
"target": {
"function": "vt_setactivate",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "288227640720784180658326713425846504175",
"length": 640.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@6550bdf52846f85a2a3726a5aa0c7c4399f2fc02",
"id": "CVE-2022-48804-6fecd989",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25389570997047978881192280726664814829",
"169426037697968425534617089563042360433",
"188095013029745694322608387398402163192",
"204540090591062794080741455828721472183",
"322435694204517763222105681151028659939"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffe54289b02e9c732d6f04c8ebbe3b2d90d32118",
"id": "CVE-2022-48804-73622316",
"signature_version": "v1",
"target": {
"function": "vt_setactivate",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "288227640720784180658326713425846504175",
"length": 640.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@61cc70d9e8ef5b042d4ed87994d20100ec8896d9",
"id": "CVE-2022-48804-7484bc54",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"25389570997047978881192280726664814829",
"169426037697968425534617089563042360433",
"188095013029745694322608387398402163192",
"204540090591062794080741455828721472183",
"322435694204517763222105681151028659939"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@170325aba4608bde3e7d21c9c19b7bc266ac0885",
"id": "CVE-2022-48804-75c63ec1",
"signature_version": "v1",
"target": {
"function": "vt_ioctl",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "53546674085811856208914555801724782184",
"length": 9997.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae3d57411562260ee3f4fd5e875f410002341104",
"id": "CVE-2022-48804-8304f1a9",
"signature_version": "v1",
"target": {
"function": "vt_ioctl",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "53546674085811856208914555801724782184",
"length": 9997.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a45a6bd1e6d651770aafff57ab3e1d3bb0b42e0",
"id": "CVE-2022-48804-8571fc7d",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150627071650387170602505094128075624183",
"148962025589324305982614510223918655814",
"310389737191671291144020893713946995782",
"126166670823020513162988840910386197258",
"68723916664151648144165261924466237363",
"104620998461786202132591034497804741473"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ae3d57411562260ee3f4fd5e875f410002341104",
"id": "CVE-2022-48804-958660e6",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150627071650387170602505094128075624183",
"148962025589324305982614510223918655814",
"310389737191671291144020893713946995782",
"126166670823020513162988840910386197258",
"68723916664151648144165261924466237363",
"104620998461786202132591034497804741473"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@170325aba4608bde3e7d21c9c19b7bc266ac0885",
"id": "CVE-2022-48804-a06e7eb7",
"signature_version": "v1",
"target": {
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"150627071650387170602505094128075624183",
"148962025589324305982614510223918655814",
"310389737191671291144020893713946995782",
"126166670823020513162988840910386197258",
"68723916664151648144165261924466237363",
"104620998461786202132591034497804741473"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@778302ca09498b448620edd372dc908bebf80bdf",
"id": "CVE-2022-48804-e325be04",
"signature_version": "v1",
"target": {
"function": "vt_setactivate",
"file": "drivers/tty/vt/vt_ioctl.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "288227640720784180658326713425846504175",
"length": 640.0
}
}
]