In the Linux kernel, the following vulnerability has been resolved:
iio: health: afe4404: Fix oob read in afe4404[read|write]raw
KASAN report out-of-bounds read as follows:
BUG: KASAN: global-out-of-bounds in afe4404readraw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278
Call Trace: afe4404readraw iioreadchannelinfo devattr_show
The buggy address belongs to the variable: afe4404channelleds+0x18/0xffffffffffffe9c0
This issue can be reproduce by singe command:
$ cat /sys/bus/i2c/devices/0-0058/iio\:device0/inintensity6raw
The array size of afe4404channelleds and afe4404channeloffdacs are less than channels, so access with chan->address cause OOB read in afe4404[read|write]raw. Fix it by moving access before use them.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68de7da092f38395dde523f2e5db26eba6c23e28",
"deprecated": false,
"id": "CVE-2022-49032-0a7343f9",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7419fc42afc035f6b29ce713e17dcd2000c833f",
"deprecated": false,
"id": "CVE-2022-49032-0d338047",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5575041ec15310bdc50c42b8b22118cc900226e",
"deprecated": false,
"id": "CVE-2022-49032-0d4bd8a0",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f566b626029ca8598d48e5074e56bb37399ca1b",
"deprecated": false,
"id": "CVE-2022-49032-0d578249",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5eb114f55b37dbc0487aa9c1913b81bb7837f1c4",
"deprecated": false,
"id": "CVE-2022-49032-10d352cd",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@113c08030a89aaf406f8a1d4549d758a67c2afba",
"deprecated": false,
"id": "CVE-2022-49032-1f9467c1",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45d9f45e7b1365fd0d9bf14680d6d5082a590d1",
"deprecated": false,
"id": "CVE-2022-49032-21db8f44",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7419fc42afc035f6b29ce713e17dcd2000c833f",
"deprecated": false,
"id": "CVE-2022-49032-271faa9c",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68de7da092f38395dde523f2e5db26eba6c23e28",
"deprecated": false,
"id": "CVE-2022-49032-2c581342",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5eb114f55b37dbc0487aa9c1913b81bb7837f1c4",
"deprecated": false,
"id": "CVE-2022-49032-57fb1665",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45d9f45e7b1365fd0d9bf14680d6d5082a590d1",
"deprecated": false,
"id": "CVE-2022-49032-5c487e1b",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@113c08030a89aaf406f8a1d4549d758a67c2afba",
"deprecated": false,
"id": "CVE-2022-49032-5d9927fa",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7419fc42afc035f6b29ce713e17dcd2000c833f",
"deprecated": false,
"id": "CVE-2022-49032-629c3310",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5575041ec15310bdc50c42b8b22118cc900226e",
"deprecated": false,
"id": "CVE-2022-49032-7ae0763c",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc92d9e3de0b2d30a3ccc08048a5fad533e4672b",
"deprecated": false,
"id": "CVE-2022-49032-7d61de02",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68de7da092f38395dde523f2e5db26eba6c23e28",
"deprecated": false,
"id": "CVE-2022-49032-9c3de4e1",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc92d9e3de0b2d30a3ccc08048a5fad533e4672b",
"deprecated": false,
"id": "CVE-2022-49032-9d217466",
"target": {
"function": "afe4404_write_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 595.0,
"function_hash": "283966984203832455978849128755766485868"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@113c08030a89aaf406f8a1d4549d758a67c2afba",
"deprecated": false,
"id": "CVE-2022-49032-a32751f5",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5575041ec15310bdc50c42b8b22118cc900226e",
"deprecated": false,
"id": "CVE-2022-49032-b1bb9e6a",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f566b626029ca8598d48e5074e56bb37399ca1b",
"deprecated": false,
"id": "CVE-2022-49032-be31b9dd",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5eb114f55b37dbc0487aa9c1913b81bb7837f1c4",
"deprecated": false,
"id": "CVE-2022-49032-ccd01393",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f566b626029ca8598d48e5074e56bb37399ca1b",
"deprecated": false,
"id": "CVE-2022-49032-ceb5696f",
"target": {
"function": "afe4404_read_raw",
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"length": 977.0,
"function_hash": "112896793371412842592788183436282362602"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc92d9e3de0b2d30a3ccc08048a5fad533e4672b",
"deprecated": false,
"id": "CVE-2022-49032-e2aff71a",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45d9f45e7b1365fd0d9bf14680d6d5082a590d1",
"deprecated": false,
"id": "CVE-2022-49032-f24bca6f",
"target": {
"file": "drivers/iio/health/afe4404.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"18159908274843342315972029250105180659",
"327592504166868998025856057412371400886",
"256003598693532640575824984643369201601",
"131790050864684228957936097421990431780",
"287912031393774554647772142628177848612",
"265087053296549217231485715413296691904",
"73785172728923363044148037010832941047",
"82400954021087591184568302353051725503",
"157686762471149497954264062516265518513",
"120738997487439249182568530399223434035",
"126635529816326297587577202598105617135",
"135712123777790774374232077038542702952",
"251645212304577307867403216636132269690",
"215203141984039568381686370232582105611",
"151118302705027813920909112879432372548",
"197630748715185089068926382446509090895",
"300152716627486013792263234380419424625",
"115953895371031930228842028296655728295",
"278016415668517804252926165830429533852",
"327650474117031354902330482209141187772",
"313155194468177872498952717485991749672",
"127158203767990351890336803122291099865",
"193968319516322005444161873088740216308",
"152648920439135149366767302861554621341",
"155052467888353282343781721027189767495",
"98880355683427174426363430619908380052",
"178745408689596917542653437589568317970",
"1915243593025279760626741112954598081",
"24360035187624704766071856497655201441",
"191159218101471429138555773208214683002",
"79976217516595435872703298631458296011",
"300152716627486013792263234380419424625",
"154524019395743516853756536338763665068",
"24353593219484209952662383011693202789",
"101883397414546395060955627549913571829"
]
},
"signature_type": "Line"
}
]