CVE-2022-49478

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-49478
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49478.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2022-49478
Downstream
Related
Published
2025-02-26T02:13:19.330Z
Modified
2026-04-11T12:44:06.447017Z
Severity
  • 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
Details

In the Linux kernel, the following vulnerability has been resolved:

media: pvrusb2: fix array-index-out-of-bounds in pvr2i2ccore_init

Syzbot reported that -1 is used as array index. The problem was in missing validation check.

hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that.

hdw->workpoll initialization moved upper to prevent warning in _flushwork.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49478.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
d855497edbfbf9e19a17f4a1154bca69cb4bd9ba
Fixed
4351bfe36aba9fa7dc9d68d498d25d41a0f45e67
Fixed
2e004fe914b243db41fa96f9e583385f360ea58e
Fixed
a3660e06675bccec4bf149c7229ea1d491ba10d7
Fixed
1310fc3538dcc375a2f46ef0a438512c2ca32827
Fixed
a3304766d9384886e6d3092c776273526947a2e9
Fixed
3309c2c574e13b21b44729f5bdbf21f60189b79a
Fixed
f99a8b1ec0eddc2931aeaa4f490277a15b39f511
Fixed
24e807541e4a9263ed928e6ae3498de3ad43bd1e
Fixed
471bec68457aaf981add77b4f590d65dd7da1059

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49478.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.18
Fixed
4.9.318
Type
ECOSYSTEM
Events
Introduced
4.10.0
Fixed
4.14.283
Type
ECOSYSTEM
Events
Introduced
4.15.0
Fixed
4.19.247
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.198
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.121
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.46
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
5.17.14
Type
ECOSYSTEM
Events
Introduced
5.18.0
Fixed
5.18.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-49478.json"