CVE-2022-48806 eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
A local attacker can trigger an integer overflow in the Linux kernel EEPROM driver by reading large blocks, potentially causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-48806?
CVE-2022-48806 is a medium-severity vulnerability in Linux kernel, published on 16 Jul 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once.
In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the length to read as an u8. If count == 256 after taking into account the offset and page boundary, the cast to u8 overflows. And this is common when user space tries to read the entire EEPROM at once.
To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.
Weakness: CWE-190
Which versions are affected by CVE-2022-48806?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-48806?
Apply the vendor's patch.
Is CVE-2022-48806 being exploited?
There is no known exploitation of CVE-2022-48806 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-48806, GHSA-xpjw-95g4-7q57, UBUNTU-CVE-2022-48806.