CVE-2022-49031 iio: health: afe4403: Fix oob read in afe4403_read_raw

What is CVE-2022-49031?

CVE-2022-49031 is a high-severity vulnerability in Linux kernel, published on 21 Oct 2024. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

iio: health: afe4403: Fix oob read in afe4403_read_raw

KASAN report out-of-bounds read as follows:

BUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0 Read of size 4 at addr ffffffffc02ac638 by task cat/279

Call Trace: afe4403_read_raw iio_read_channel_info dev_attr_show

The buggy address belongs to the variable: afe4403_channel_leds+0x18/0xffffffffffffe9e0

This issue can be reproduced by singe command:

$ cat /sys/bus/spi/devices/spi0.0/iio\:device0/in_intensity6_raw

The array size of afe4403_channel_leds is less than channels, so access with chan->address cause OOB read in afe4403_read_raw. Fix it by moving access before use it.

Weakness: CWE-125

Which versions are affected by CVE-2022-49031?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2022-49031?

Apply the vendor's patch.

Is CVE-2022-49031 being exploited?

There is no known exploitation of CVE-2022-49031 in the wild and no public exploit code.

Other vulnerabilities in Linux kernel

• CVE-2026-53266 Linux Kernel Out-of-Bounds Write Exploited High 8.8
• CVE-2013-6282 Linux Kernel Improper Input Validation Exploited High 8.8
• CVE-2022-0185 Linux Kernel Heap-Based Buffer Overflow Exploited High 8.4
• CVE-2013-2094 Linux Kernel Privilege Escalation Exploited High 8.4
• CVE-2026-53362 Linux Kernel Unspecified Exploited High 7.8

All Linux kernel vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2022-49031, GHSA-4667-xxv8-3pq6, UBUNTU-CVE-2022-49031.