In the Linux kernel, the following vulnerability has been resolved:
CDC-NCM: avoid overflow in sanity checking
A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a612395c7631918e0e10ea48b9ce5ab4340f26a6",
"target": {
"function": "cdc_ncm_rx_fixup",
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-2ea734d5",
"signature_version": "v1",
"digest": {
"length": 2384.0,
"function_hash": "174652395845778769354835924210978465385"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b737e47b87589031f0d4657f6d7b0b770474925",
"target": {
"function": "cdc_ncm_rx_fixup",
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-401ca407",
"signature_version": "v1",
"digest": {
"length": 2384.0,
"function_hash": "174652395845778769354835924210978465385"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9957fbf34f52a4d8945d1bf39aae400ef9a11246",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-449b680c",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50251013734388391233606986111088444771",
"137490950605198487309837475440931731626",
"19752167087699303282715303905789433975",
"257215703165682940721112279768405924735",
"79837679963229094435042903361650057394",
"270994786534807869921621568715035486313",
"212055566490873669601124262865456959680",
"283603984236951918173895394009023562666",
"74703237292173746737425773475708376291",
"245081019859241893937390384135828461136",
"72357240426459970518223221695218951578"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b737e47b87589031f0d4657f6d7b0b770474925",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-55e0e255",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50251013734388391233606986111088444771",
"137490950605198487309837475440931731626",
"19752167087699303282715303905789433975",
"257215703165682940721112279768405924735",
"79837679963229094435042903361650057394",
"270994786534807869921621568715035486313",
"212055566490873669601124262865456959680",
"283603984236951918173895394009023562666",
"74703237292173746737425773475708376291",
"245081019859241893937390384135828461136",
"72357240426459970518223221695218951578"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69560efa001397ebb8dc1c3e6a3ce00302bb9f7f",
"target": {
"function": "cdc_ncm_rx_fixup",
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-5fcfcfe1",
"signature_version": "v1",
"digest": {
"length": 2384.0,
"function_hash": "174652395845778769354835924210978465385"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d2b1a1ec9f559d30b724877da4ce592edc41fdc",
"target": {
"function": "cdc_ncm_rx_fixup",
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-96370e17",
"signature_version": "v1",
"digest": {
"length": 2384.0,
"function_hash": "174652395845778769354835924210978465385"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@69560efa001397ebb8dc1c3e6a3ce00302bb9f7f",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-a0ff1888",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50251013734388391233606986111088444771",
"137490950605198487309837475440931731626",
"19752167087699303282715303905789433975",
"257215703165682940721112279768405924735",
"79837679963229094435042903361650057394",
"270994786534807869921621568715035486313",
"212055566490873669601124262865456959680",
"283603984236951918173895394009023562666",
"74703237292173746737425773475708376291",
"245081019859241893937390384135828461136",
"72357240426459970518223221695218951578"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49909c9f8458cacb5b241106cba65aba5a6d8f4c",
"target": {
"function": "cdc_ncm_rx_fixup",
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-b3fb6d34",
"signature_version": "v1",
"digest": {
"length": 2384.0,
"function_hash": "174652395845778769354835924210978465385"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9957fbf34f52a4d8945d1bf39aae400ef9a11246",
"target": {
"function": "cdc_ncm_rx_fixup",
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-c3ee2063",
"signature_version": "v1",
"digest": {
"length": 2384.0,
"function_hash": "174652395845778769354835924210978465385"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a612395c7631918e0e10ea48b9ce5ab4340f26a6",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-d034c105",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50251013734388391233606986111088444771",
"137490950605198487309837475440931731626",
"19752167087699303282715303905789433975",
"257215703165682940721112279768405924735",
"79837679963229094435042903361650057394",
"270994786534807869921621568715035486313",
"212055566490873669601124262865456959680",
"283603984236951918173895394009023562666",
"74703237292173746737425773475708376291",
"245081019859241893937390384135828461136",
"72357240426459970518223221695218951578"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8d2b1a1ec9f559d30b724877da4ce592edc41fdc",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-d74490c4",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50251013734388391233606986111088444771",
"137490950605198487309837475440931731626",
"19752167087699303282715303905789433975",
"257215703165682940721112279768405924735",
"79837679963229094435042903361650057394",
"270994786534807869921621568715035486313",
"212055566490873669601124262865456959680",
"283603984236951918173895394009023562666",
"74703237292173746737425773475708376291",
"245081019859241893937390384135828461136",
"72357240426459970518223221695218951578"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@49909c9f8458cacb5b241106cba65aba5a6d8f4c",
"target": {
"file": "drivers/net/usb/cdc_ncm.c"
},
"deprecated": false,
"id": "CVE-2022-48938-de2d834b",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"50251013734388391233606986111088444771",
"137490950605198487309837475440931731626",
"19752167087699303282715303905789433975",
"257215703165682940721112279768405924735",
"79837679963229094435042903361650057394",
"270994786534807869921621568715035486313",
"212055566490873669601124262865456959680",
"283603984236951918173895394009023562666",
"74703237292173746737425773475708376291",
"245081019859241893937390384135828461136",
"72357240426459970518223221695218951578"
]
},
"signature_type": "Line"
}
]