From bippy-d175d3acf727 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman To: Reply-to: , Subject: CVE-2022-48632: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() Description =========== In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments. The Linux kernel CVE team has assigned CVE-2022-48632 to this issue. Affected and fixed versions =========================== Issue introduced in 5.10 with commit b5b5b32081cd and fixed in 5.10.146 with commit 48ee0a864d1a Issue introduced in 5.10 with commit b5b5b32081cd and fixed in 5.15.71 with commit dc2a0c587006 Issue introduced in 5.10 with commit b5b5b32081cd and fixed in 5.19.12 with commit 3b5ab5fbe69e Issue introduced in 5.10 with commit b5b5b32081cd and fixed in 6.0 with commit de24aceb07d4 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-48632 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/i2c/busses/i2c-mlxbf.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2 https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8 https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b