In the Linux kernel, the following vulnerability has been resolved:
HID: cp2112: prevent a buffer overflow in cp2112_xfer()
Smatch warnings: drivers/hid/hid-cp2112.c:793 cp2112xfer() error: _memcpy() 'data->block[1]' too small (33 vs 255) drivers/hid/hid-cp2112.c:793 cp2112xfer() error: _memcpy() 'buf' too small (64 vs 255)
The 'readlength' variable is provided by 'data->block[0]' which comes from user and it(readlength) can take a value between 0-255. Add an upper bound to 'read_length' variable to prevent a buffer overflow in memcpy().
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7028944e61014ae915e7fb74963d3835f2f761a",
"id": "CVE-2022-50156-1b4b4e42",
"digest": {
"function_hash": "204753965324534102361521612527828483348",
"length": 3726.0
},
"target": {
"function": "cp2112_xfer",
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8489a20ac481b08c0391608d81ed3796d373cfdf",
"id": "CVE-2022-50156-2add54c3",
"digest": {
"function_hash": "204753965324534102361521612527828483348",
"length": 3726.0
},
"target": {
"function": "cp2112_xfer",
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebda3d6b004bb6127a66a616524a2de152302ca7",
"id": "CVE-2022-50156-34087bfd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161718811197079516770811120651818109591",
"324670165178254759637203558212238289159",
"121900002244094613697362514953364447677",
"57922080414031996578225968468700836997"
]
},
"target": {
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@519ff31a6ddd87aa4905bd9bf3b92e8b88801614",
"id": "CVE-2022-50156-35fa2755",
"digest": {
"function_hash": "204753965324534102361521612527828483348",
"length": 3726.0
},
"target": {
"function": "cp2112_xfer",
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@381583845d19cb4bd21c8193449385f3fefa9caf",
"id": "CVE-2022-50156-457b401b",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161718811197079516770811120651818109591",
"324670165178254759637203558212238289159",
"121900002244094613697362514953364447677",
"57922080414031996578225968468700836997"
]
},
"target": {
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3af7d60e9a6c17d6d41c4341f8020511887d372d",
"id": "CVE-2022-50156-45a87795",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161718811197079516770811120651818109591",
"324670165178254759637203558212238289159",
"121900002244094613697362514953364447677",
"57922080414031996578225968468700836997"
]
},
"target": {
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26e427ac85c2b8d0d108cc80b6de34d33e2780c4",
"id": "CVE-2022-50156-49a786b0",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161718811197079516770811120651818109591",
"324670165178254759637203558212238289159",
"121900002244094613697362514953364447677",
"57922080414031996578225968468700836997"
]
},
"target": {
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@26e427ac85c2b8d0d108cc80b6de34d33e2780c4",
"id": "CVE-2022-50156-4ef05440",
"digest": {
"function_hash": "204753965324534102361521612527828483348",
"length": 3726.0
},
"target": {
"function": "cp2112_xfer",
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8489a20ac481b08c0391608d81ed3796d373cfdf",
"id": "CVE-2022-50156-5c1c8815",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161718811197079516770811120651818109591",
"324670165178254759637203558212238289159",
"121900002244094613697362514953364447677",
"57922080414031996578225968468700836997"
]
},
"target": {
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@519ff31a6ddd87aa4905bd9bf3b92e8b88801614",
"id": "CVE-2022-50156-93fe6505",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161718811197079516770811120651818109591",
"324670165178254759637203558212238289159",
"121900002244094613697362514953364447677",
"57922080414031996578225968468700836997"
]
},
"target": {
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Line",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ebda3d6b004bb6127a66a616524a2de152302ca7",
"id": "CVE-2022-50156-94f677c1",
"digest": {
"function_hash": "204753965324534102361521612527828483348",
"length": 3726.0
},
"target": {
"function": "cp2112_xfer",
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3af7d60e9a6c17d6d41c4341f8020511887d372d",
"id": "CVE-2022-50156-9752320b",
"digest": {
"function_hash": "204753965324534102361521612527828483348",
"length": 3726.0
},
"target": {
"function": "cp2112_xfer",
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@381583845d19cb4bd21c8193449385f3fefa9caf",
"id": "CVE-2022-50156-d9c1740d",
"digest": {
"function_hash": "204753965324534102361521612527828483348",
"length": 3726.0
},
"target": {
"function": "cp2112_xfer",
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Function",
"signature_version": "v1"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e7028944e61014ae915e7fb74963d3835f2f761a",
"id": "CVE-2022-50156-eefcd0de",
"digest": {
"threshold": 0.9,
"line_hashes": [
"161718811197079516770811120651818109591",
"324670165178254759637203558212238289159",
"121900002244094613697362514953364447677",
"57922080414031996578225968468700836997"
]
},
"target": {
"file": "drivers/hid/hid-cp2112.c"
},
"signature_type": "Line",
"signature_version": "v1"
}
]