In the Linux kernel, the following vulnerability has been resolved:
net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
ax88179rxfixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular:
I have tested that this can be used by a malicious USB device to send a bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response that contains random kernel heap data. It's probably also possible to get OOB writes from this on a little-endian system somehow - maybe by triggering skb_cow() via IP options processing -, but I haven't tested that.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@758290defe93a865a2880d10c5d5abd288b64b5d",
"id": "CVE-2022-48805-0adc9b16",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"60499530523833510487660923955138571781",
"115723978318491451378391294843909990029",
"96392940395171158057656170263442034211",
"47675576287732456563267005539719290877",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1668781ed24da43498799aa4f65714a7de201930",
"id": "CVE-2022-48805-11e1aa3b",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1108.0,
"function_hash": "142814568495071324983003522073932706485"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581",
"id": "CVE-2022-48805-30192269",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"60499530523833510487660923955138571781",
"115723978318491451378391294843909990029",
"96392940395171158057656170263442034211",
"47675576287732456563267005539719290877",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@711b6bf3fb052f0a6b5b3205d50e30c0c2980382",
"id": "CVE-2022-48805-44719801",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1108.0,
"function_hash": "142814568495071324983003522073932706485"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581",
"id": "CVE-2022-48805-45454481",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "209771301034762066406253082537022329490"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9681823f96a811268265f35307072ad80713c274",
"id": "CVE-2022-48805-54a1feb4",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "209771301034762066406253082537022329490"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffd0393adcdcefab7e131488e10dcfde5e02d6eb",
"id": "CVE-2022-48805-66372043",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"60499530523833510487660923955138571781",
"115723978318491451378391294843909990029",
"96392940395171158057656170263442034211",
"47675576287732456563267005539719290877",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0fd5492ee769029a636f1fb521716b022b1423d",
"id": "CVE-2022-48805-6c2703b4",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"60499530523833510487660923955138571781",
"115723978318491451378391294843909990029",
"96392940395171158057656170263442034211",
"47675576287732456563267005539719290877",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@758290defe93a865a2880d10c5d5abd288b64b5d",
"id": "CVE-2022-48805-75724c07",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "209771301034762066406253082537022329490"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ffd0393adcdcefab7e131488e10dcfde5e02d6eb",
"id": "CVE-2022-48805-872e34a4",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "209771301034762066406253082537022329490"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@711b6bf3fb052f0a6b5b3205d50e30c0c2980382",
"id": "CVE-2022-48805-a27e8e68",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"116140370572909413970190352901227640819",
"312346127882830974949436475134312540410",
"241672284752460114505048400884959229518",
"236116459120911032363908627175376848700",
"251242535054664914200406301570085924441",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a0fd5492ee769029a636f1fb521716b022b1423d",
"id": "CVE-2022-48805-b4ffe03f",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1081.0,
"function_hash": "209771301034762066406253082537022329490"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1668781ed24da43498799aa4f65714a7de201930",
"id": "CVE-2022-48805-b74d8799",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"116140370572909413970190352901227640819",
"312346127882830974949436475134312540410",
"241672284752460114505048400884959229518",
"236116459120911032363908627175376848700",
"251242535054664914200406301570085924441",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9681823f96a811268265f35307072ad80713c274",
"id": "CVE-2022-48805-e4b588c9",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"60499530523833510487660923955138571781",
"115723978318491451378391294843909990029",
"96392940395171158057656170263442034211",
"47675576287732456563267005539719290877",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63f0cfb36c1f1964a59ce544156677601e2d8740",
"id": "CVE-2022-48805-f4cdb339",
"deprecated": false,
"target": {
"function": "ax88179_rx_fixup",
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Function",
"digest": {
"length": 1108.0,
"function_hash": "142814568495071324983003522073932706485"
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63f0cfb36c1f1964a59ce544156677601e2d8740",
"id": "CVE-2022-48805-fc8dbadc",
"deprecated": false,
"target": {
"file": "drivers/net/usb/ax88179_178a.c"
},
"signature_version": "v1",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"52585718156563099239927986756117928212",
"111865358850331982991855074580458971095",
"202495561126426403668986475081047867305",
"116140370572909413970190352901227640819",
"312346127882830974949436475134312540410",
"241672284752460114505048400884959229518",
"236116459120911032363908627175376848700",
"251242535054664914200406301570085924441",
"224594654650403452193418254961894072933",
"328004313900229699321286455715507349483",
"96631401295868541563792457366656626637",
"70272671712229035209267713212977781436",
"195422682052505261823171472097133236811",
"162002774478071333642768982455786485904",
"262221211159281345808208983727869927066",
"124534366800995668145147433085372463269",
"17078136641649173426755519136229907423",
"62996954265444676515970476617025496221",
"197700024721782343999313320289473944005",
"330856553798838852164665743204195604397",
"102500747662624894322733028985558390566",
"198070727028890967445928377775682721055",
"33316205205385912317549215947722599858",
"217483437510017581398622318892142358496",
"250150436086612037178818166002687501477",
"264874194310145465898277657671237690519",
"5291642779010852866434632957240917526",
"24352940777625451187230400713910513656",
"259262198910347796493916521435457342902",
"76907173969344598325220031951102738421",
"42320031148596123921787802239893391864",
"235550332120144385963084950585264314687",
"78390308129690810987504864748988446139",
"324662107254450735758593065215192754014",
"187615223986388882560639475920315068804",
"285186844713142478303459408629591503325",
"58671836749939899384448583916010427992",
"51828097530116500909167475238653703419",
"229453834710615008884169224042592755931",
"175956748291709552028620375152113064616",
"85481168555633766337519370744536952183",
"315306575104821056944663506505050423771",
"83796028136324933186273966997372455997",
"315949738771773777261559641651440349150"
]
}
}
]