In the Linux kernel, the following vulnerability has been resolved:
iio: health: afe4404: Fix oob read in afe4404[read|write]raw
KASAN report out-of-bounds read as follows:
BUG: KASAN: global-out-of-bounds in afe4404readraw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278
Call Trace: afe4404readraw iioreadchannelinfo devattr_show
The buggy address belongs to the variable: afe4404channelleds+0x18/0xffffffffffffe9c0
This issue can be reproduce by singe command:
$ cat /sys/bus/i2c/devices/0-0058/iio\:device0/inintensity6raw
The array size of afe4404channelleds and afe4404channeloffdacs are less than channels, so access with chan->address cause OOB read in afe4404[read|write]raw. Fix it by moving access before use them.
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68de7da092f38395dde523f2e5db26eba6c23e28", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-0a7343f9", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7419fc42afc035f6b29ce713e17dcd2000c833f", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-0d338047", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5575041ec15310bdc50c42b8b22118cc900226e", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-0d4bd8a0", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f566b626029ca8598d48e5074e56bb37399ca1b", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-0d578249", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5eb114f55b37dbc0487aa9c1913b81bb7837f1c4", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-10d352cd", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@113c08030a89aaf406f8a1d4549d758a67c2afba", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-1f9467c1", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45d9f45e7b1365fd0d9bf14680d6d5082a590d1", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-21db8f44", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7419fc42afc035f6b29ce713e17dcd2000c833f", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-271faa9c", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68de7da092f38395dde523f2e5db26eba6c23e28", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-2c581342", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5eb114f55b37dbc0487aa9c1913b81bb7837f1c4", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-57fb1665", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45d9f45e7b1365fd0d9bf14680d6d5082a590d1", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-5c487e1b", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@113c08030a89aaf406f8a1d4549d758a67c2afba", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-5d9927fa", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f7419fc42afc035f6b29ce713e17dcd2000c833f", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-629c3310", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5575041ec15310bdc50c42b8b22118cc900226e", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-7ae0763c", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc92d9e3de0b2d30a3ccc08048a5fad533e4672b", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-7d61de02", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@68de7da092f38395dde523f2e5db26eba6c23e28", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-9c3de4e1", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc92d9e3de0b2d30a3ccc08048a5fad533e4672b", "target": { "function": "afe4404_write_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 595.0, "function_hash": "283966984203832455978849128755766485868" }, "deprecated": false, "id": "CVE-2022-49032-9d217466", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@113c08030a89aaf406f8a1d4549d758a67c2afba", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-a32751f5", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f5575041ec15310bdc50c42b8b22118cc900226e", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-b1bb9e6a", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f566b626029ca8598d48e5074e56bb37399ca1b", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-be31b9dd", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5eb114f55b37dbc0487aa9c1913b81bb7837f1c4", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-ccd01393", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3f566b626029ca8598d48e5074e56bb37399ca1b", "target": { "function": "afe4404_read_raw", "file": "drivers/iio/health/afe4404.c" }, "digest": { "length": 977.0, "function_hash": "112896793371412842592788183436282362602" }, "deprecated": false, "id": "CVE-2022-49032-ceb5696f", "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fc92d9e3de0b2d30a3ccc08048a5fad533e4672b", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-e2aff71a", "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d45d9f45e7b1365fd0d9bf14680d6d5082a590d1", "target": { "file": "drivers/iio/health/afe4404.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "18159908274843342315972029250105180659", "327592504166868998025856057412371400886", "256003598693532640575824984643369201601", "131790050864684228957936097421990431780", "287912031393774554647772142628177848612", "265087053296549217231485715413296691904", "73785172728923363044148037010832941047", "82400954021087591184568302353051725503", "157686762471149497954264062516265518513", "120738997487439249182568530399223434035", "126635529816326297587577202598105617135", "135712123777790774374232077038542702952", "251645212304577307867403216636132269690", "215203141984039568381686370232582105611", "151118302705027813920909112879432372548", "197630748715185089068926382446509090895", "300152716627486013792263234380419424625", "115953895371031930228842028296655728295", "278016415668517804252926165830429533852", "327650474117031354902330482209141187772", "313155194468177872498952717485991749672", "127158203767990351890336803122291099865", "193968319516322005444161873088740216308", "152648920439135149366767302861554621341", "155052467888353282343781721027189767495", "98880355683427174426363430619908380052", "178745408689596917542653437589568317970", "1915243593025279760626741112954598081", "24360035187624704766071856497655201441", "191159218101471429138555773208214683002", "79976217516595435872703298631458296011", "300152716627486013792263234380419424625", "154524019395743516853756536338763665068", "24353593219484209952662383011693202789", "101883397414546395060955627549913571829" ] }, "deprecated": false, "id": "CVE-2022-49032-f24bca6f", "signature_type": "Line", "signature_version": "v1" } ] }