In the Linux kernel, the following vulnerability has been resolved:
mmc: core: use sysfs_emit() instead of sprintf()
sprintf() (still used in the MMC core for the sysfs output) is vulnerable to the buffer overflow. Use the new-fangled sysfs_emit() instead.
Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.
[
{
"signature_type": "Line",
"id": "CVE-2022-49267-1023d1f8",
"target": {
"file": "drivers/mmc/core/sdio.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11",
"signature_version": "v1",
"digest": {
"line_hashes": [
"230215375852388356714204040389835782860",
"335312055211086528502174284550807848338",
"308251235466872937681435024650748143802",
"310273058998710922906564484590177204881",
"286715297725139315652535612242981458000",
"304945423157012239207511571952371143299",
"26310293424975262704614050976401307004",
"12583117165275292054826148463869902438"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-180a42d6",
"target": {
"file": "drivers/mmc/core/bus.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@659ca56b5415c7a1d05e185c36fad80ba165d063",
"signature_version": "v1",
"digest": {
"line_hashes": [
"9011163733901154307670760716352392785",
"252949015465953890844706289668729136155",
"183067405695140370756517568795689254711",
"67682152859548018540743972109561636038",
"21312210032194806713073545093263781233",
"110910459811339949854288805294883007407"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-3036b303",
"target": {
"file": "drivers/mmc/core/sd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@659ca56b5415c7a1d05e185c36fad80ba165d063",
"signature_version": "v1",
"digest": {
"line_hashes": [
"263467163666527416871893020365039004572",
"306899847427753823269921713105748166325",
"31348899389309759487242140216965613323",
"264923950450729628023176223049162679352",
"287239404656572266089994105943066396214",
"243285727948690231565702088409342456250",
"276870308512498512880281574357487039712",
"258892871890625969805960094858109345003",
"178592500314933306350728198143810704128",
"70552493633313329756371137545958965353",
"179881726154546922038256561438270007487",
"99604587042541681500878304242187628251",
"150195290062058108643388698458249933931",
"218556122219832584768284761884101750418",
"113259640494079524747819208426699238862",
"238084107965048371205850478219500193075",
"261658219514413913706337268644625081015",
"308251235466872937681435024650748143802",
"310273058998710922906564484590177204881",
"286715297725139315652535612242981458000",
"304945423157012239207511571952371143299",
"26310293424975262704614050976401307004",
"12583117165275292054826148463869902438"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-3e8caf96",
"target": {
"file": "drivers/mmc/core/sdio_bus.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ab65738ab3e21fe519ee46b2051222bc8e32ef",
"signature_version": "v1",
"digest": {
"line_hashes": [
"160723194710744713590061494799924154584",
"89225685850698436279792150954892194043",
"139492495968275771995680318803095794421",
"105154971619003456600241477358687623126",
"150523310214347632828058908642254429677",
"172418963695546234870745207060461544095",
"55520396269222940543443087083492704185",
"156412102378509963723337134429776928246",
"113931860779559220154682347926143441741",
"215179599684942226342998636167312886896",
"175534743682925684688315544959176494662",
"284013826869728034056880428016140016563",
"134990455594241489307094988102362662683",
"33809677184329840369741877544768977415"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-51b9363b",
"target": {
"file": "drivers/mmc/core/sdio_bus.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11",
"signature_version": "v1",
"digest": {
"line_hashes": [
"160723194710744713590061494799924154584",
"89225685850698436279792150954892194043",
"139492495968275771995680318803095794421",
"105154971619003456600241477358687623126",
"150523310214347632828058908642254429677",
"172418963695546234870745207060461544095",
"55520396269222940543443087083492704185",
"156412102378509963723337134429776928246",
"113931860779559220154682347926143441741",
"215179599684942226342998636167312886896",
"175534743682925684688315544959176494662",
"284013826869728034056880428016140016563",
"134990455594241489307094988102362662683",
"33809677184329840369741877544768977415"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-552fbb06",
"target": {
"file": "drivers/mmc/core/bus.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ab65738ab3e21fe519ee46b2051222bc8e32ef",
"signature_version": "v1",
"digest": {
"line_hashes": [
"249887938897869848753383911325971158577",
"198800202139999365846836137964070387994",
"312856717201430677404964414038743997263",
"9970156619177745290045082578966400758",
"54949170971404772974665814420450978444",
"315146767320162572254755046798308583276",
"216218485467275466282957796909989789292",
"125540105054845811505750247879843188981",
"39209836858147058633080398381094691527",
"247592300697237024790646158287062860455",
"104444738612760169219655015082895892937",
"52994051224797467974368511306127835003",
"157683681235860045429629000272976792003",
"292232238715026990577653115616673082437"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2022-49267-616af3a8",
"target": {
"function": "mmc_fwrev_show",
"file": "drivers/mmc/core/mmc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ab65738ab3e21fe519ee46b2051222bc8e32ef",
"signature_version": "v1",
"digest": {
"function_hash": "10790681770930401218901717827930335243",
"length": 301.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-631a8949",
"target": {
"file": "drivers/mmc/core/sd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ab65738ab3e21fe519ee46b2051222bc8e32ef",
"signature_version": "v1",
"digest": {
"line_hashes": [
"263467163666527416871893020365039004572",
"306899847427753823269921713105748166325",
"31348899389309759487242140216965613323",
"264923950450729628023176223049162679352",
"287239404656572266089994105943066396214",
"243285727948690231565702088409342456250",
"276870308512498512880281574357487039712",
"258892871890625969805960094858109345003",
"178592500314933306350728198143810704128",
"70552493633313329756371137545958965353",
"179881726154546922038256561438270007487",
"99604587042541681500878304242187628251",
"150195290062058108643388698458249933931",
"218556122219832584768284761884101750418",
"113259640494079524747819208426699238862",
"238084107965048371205850478219500193075",
"261658219514413913706337268644625081015",
"308251235466872937681435024650748143802",
"310273058998710922906564484590177204881",
"286715297725139315652535612242981458000",
"304945423157012239207511571952371143299",
"26310293424975262704614050976401307004",
"12583117165275292054826148463869902438"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-6ba6368f",
"target": {
"file": "drivers/mmc/core/mmc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11",
"signature_version": "v1",
"digest": {
"line_hashes": [
"294402295376118542418392997765981318766",
"185120122855018892318196139489005629890",
"119699316556828031764245633789023945455",
"335312055211086528502174284550807848338",
"293141928464278088097440221396752572346",
"238351828252491757690148794984949668445",
"133610199414540733978462915095015229058",
"175638231298489662915578753516725293095",
"264990499586582159960750924844950585908",
"295060526012412713140828091424776963645",
"186787957377944178563888461081919693396",
"141036519553808796111397182198805460140",
"302366638192731710399046777688422872367",
"99604587042541681500878304242187628251",
"150195290062058108643388698458249933931",
"218556122219832584768284761884101750418",
"113259640494079524747819208426699238862",
"238084107965048371205850478219500193075",
"34427431352583549949260105090843787623"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-7591bef2",
"target": {
"file": "drivers/mmc/core/sdio.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@659ca56b5415c7a1d05e185c36fad80ba165d063",
"signature_version": "v1",
"digest": {
"line_hashes": [
"230215375852388356714204040389835782860",
"335312055211086528502174284550807848338",
"308251235466872937681435024650748143802",
"310273058998710922906564484590177204881",
"286715297725139315652535612242981458000",
"304945423157012239207511571952371143299",
"26310293424975262704614050976401307004",
"12583117165275292054826148463869902438"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-770e26dd",
"target": {
"file": "drivers/mmc/core/mmc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ab65738ab3e21fe519ee46b2051222bc8e32ef",
"signature_version": "v1",
"digest": {
"line_hashes": [
"294402295376118542418392997765981318766",
"185120122855018892318196139489005629890",
"119699316556828031764245633789023945455",
"335312055211086528502174284550807848338",
"293141928464278088097440221396752572346",
"238351828252491757690148794984949668445",
"133610199414540733978462915095015229058",
"175638231298489662915578753516725293095",
"264990499586582159960750924844950585908",
"295060526012412713140828091424776963645",
"186787957377944178563888461081919693396",
"141036519553808796111397182198805460140",
"302366638192731710399046777688422872367",
"99604587042541681500878304242187628251",
"150195290062058108643388698458249933931",
"218556122219832584768284761884101750418",
"113259640494079524747819208426699238862",
"238084107965048371205850478219500193075",
"34427431352583549949260105090843787623"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-7ad4d3ea",
"target": {
"file": "drivers/mmc/core/sdio_bus.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@659ca56b5415c7a1d05e185c36fad80ba165d063",
"signature_version": "v1",
"digest": {
"line_hashes": [
"160723194710744713590061494799924154584",
"89225685850698436279792150954892194043",
"139492495968275771995680318803095794421",
"105154971619003456600241477358687623126",
"150523310214347632828058908642254429677",
"172418963695546234870745207060461544095",
"55520396269222940543443087083492704185",
"156412102378509963723337134429776928246",
"113931860779559220154682347926143441741",
"215179599684942226342998636167312886896",
"175534743682925684688315544959176494662",
"284013826869728034056880428016140016563",
"134990455594241489307094988102362662683",
"33809677184329840369741877544768977415"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2022-49267-86b907cb",
"target": {
"function": "mmc_fwrev_show",
"file": "drivers/mmc/core/mmc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@659ca56b5415c7a1d05e185c36fad80ba165d063",
"signature_version": "v1",
"digest": {
"function_hash": "10790681770930401218901717827930335243",
"length": 301.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-98ac7e08",
"target": {
"file": "drivers/mmc/core/mmc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@659ca56b5415c7a1d05e185c36fad80ba165d063",
"signature_version": "v1",
"digest": {
"line_hashes": [
"294402295376118542418392997765981318766",
"185120122855018892318196139489005629890",
"119699316556828031764245633789023945455",
"335312055211086528502174284550807848338",
"293141928464278088097440221396752572346",
"238351828252491757690148794984949668445",
"133610199414540733978462915095015229058",
"175638231298489662915578753516725293095",
"264990499586582159960750924844950585908",
"295060526012412713140828091424776963645",
"186787957377944178563888461081919693396",
"141036519553808796111397182198805460140",
"302366638192731710399046777688422872367",
"99604587042541681500878304242187628251",
"150195290062058108643388698458249933931",
"218556122219832584768284761884101750418",
"113259640494079524747819208426699238862",
"238084107965048371205850478219500193075",
"34427431352583549949260105090843787623"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-b78ba702",
"target": {
"file": "drivers/mmc/core/sdio.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ab65738ab3e21fe519ee46b2051222bc8e32ef",
"signature_version": "v1",
"digest": {
"line_hashes": [
"230215375852388356714204040389835782860",
"335312055211086528502174284550807848338",
"308251235466872937681435024650748143802",
"310273058998710922906564484590177204881",
"286715297725139315652535612242981458000",
"304945423157012239207511571952371143299",
"26310293424975262704614050976401307004",
"12583117165275292054826148463869902438"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-d508fb26",
"target": {
"file": "drivers/mmc/core/bus.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11",
"signature_version": "v1",
"digest": {
"line_hashes": [
"249887938897869848753383911325971158577",
"198800202139999365846836137964070387994",
"312856717201430677404964414038743997263",
"9970156619177745290045082578966400758",
"54949170971404772974665814420450978444",
"315146767320162572254755046798308583276",
"216218485467275466282957796909989789292",
"125540105054845811505750247879843188981",
"39209836858147058633080398381094691527",
"247592300697237024790646158287062860455",
"104444738612760169219655015082895892937",
"52994051224797467974368511306127835003",
"157683681235860045429629000272976792003",
"292232238715026990577653115616673082437"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "CVE-2022-49267-e3a33234",
"target": {
"function": "mmc_fwrev_show",
"file": "drivers/mmc/core/mmc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11",
"signature_version": "v1",
"digest": {
"function_hash": "10790681770930401218901717827930335243",
"length": 301.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-e4608156",
"target": {
"file": "drivers/mmc/core/sd.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11",
"signature_version": "v1",
"digest": {
"line_hashes": [
"263467163666527416871893020365039004572",
"306899847427753823269921713105748166325",
"31348899389309759487242140216965613323",
"264923950450729628023176223049162679352",
"287239404656572266089994105943066396214",
"243285727948690231565702088409342456250",
"276870308512498512880281574357487039712",
"258892871890625969805960094858109345003",
"178592500314933306350728198143810704128",
"70552493633313329756371137545958965353",
"179881726154546922038256561438270007487",
"99604587042541681500878304242187628251",
"150195290062058108643388698458249933931",
"218556122219832584768284761884101750418",
"113259640494079524747819208426699238862",
"238084107965048371205850478219500193075",
"261658219514413913706337268644625081015",
"308251235466872937681435024650748143802",
"310273058998710922906564484590177204881",
"286715297725139315652535612242981458000",
"304945423157012239207511571952371143299",
"26310293424975262704614050976401307004",
"12583117165275292054826148463869902438"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-f652f4c5",
"target": {
"file": "drivers/mmc/core/bus.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@659ca56b5415c7a1d05e185c36fad80ba165d063",
"signature_version": "v1",
"digest": {
"line_hashes": [
"249887938897869848753383911325971158577",
"198800202139999365846836137964070387994",
"312856717201430677404964414038743997263",
"9970156619177745290045082578966400758",
"54949170971404772974665814420450978444",
"315146767320162572254755046798308583276",
"216218485467275466282957796909989789292",
"125540105054845811505750247879843188981",
"39209836858147058633080398381094691527",
"247592300697237024790646158287062860455",
"104444738612760169219655015082895892937",
"52994051224797467974368511306127835003",
"157683681235860045429629000272976792003",
"292232238715026990577653115616673082437"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-f942e4c4",
"target": {
"file": "drivers/mmc/core/bus.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5d8a5fe77ce933f53eb8f2e22bb7a1a2019ea11",
"signature_version": "v1",
"digest": {
"line_hashes": [
"9011163733901154307670760716352392785",
"252949015465953890844706289668729136155",
"183067405695140370756517568795689254711",
"67682152859548018540743972109561636038",
"21312210032194806713073545093263781233",
"110910459811339949854288805294883007407"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "CVE-2022-49267-f9732388",
"target": {
"file": "drivers/mmc/core/bus.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c4ab65738ab3e21fe519ee46b2051222bc8e32ef",
"signature_version": "v1",
"digest": {
"line_hashes": [
"9011163733901154307670760716352392785",
"252949015465953890844706289668729136155",
"183067405695140370756517568795689254711",
"67682152859548018540743972109561636038",
"21312210032194806713073545093263781233",
"110910459811339949854288805294883007407"
],
"threshold": 0.9
},
"deprecated": false
}
]