CVE-2022-50156
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-50156
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-50156.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2022-50156
- Related
- Published
- 2025-06-18T11:15:45Z
- Modified
- 2025-06-18T16:48:50.568562Z
- Downstream
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
HID: cp2112: prevent a buffer overflow in cp2112_xfer()
Smatch warnings: drivers/hid/hid-cp2112.c:793 cp2112xfer() error: _memcpy() 'data->block[1]' too small (33 vs 255) drivers/hid/hid-cp2112.c:793 cp2112xfer() error: _memcpy() 'buf' too small (64 vs 255)
The 'readlength' variable is provided by 'data->block[0]' which comes from user and it(readlength) can take a value between 0-255. Add an upper bound to 'read_length' variable to prevent a buffer overflow in memcpy().
- References
-
- https://git.kernel.org/stable/c/26e427ac85c2b8d0d108cc80b6de34d33e2780c4
- https://git.kernel.org/stable/c/381583845d19cb4bd21c8193449385f3fefa9caf
- https://git.kernel.org/stable/c/3af7d60e9a6c17d6d41c4341f8020511887d372d
- https://git.kernel.org/stable/c/519ff31a6ddd87aa4905bd9bf3b92e8b88801614
- https://git.kernel.org/stable/c/8489a20ac481b08c0391608d81ed3796d373cfdf
- https://git.kernel.org/stable/c/e7028944e61014ae915e7fb74963d3835f2f761a
- https://git.kernel.org/stable/c/ebda3d6b004bb6127a66a616524a2de152302ca7
- https://security-tracker.debian.org/tracker/CVE-2022-50156
Affected packages
Debian:11 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed5.10.140-1
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source