DEBIAN-CVE-2022-49551
- Source
- https://security-tracker.debian.org/tracker/CVE-2022-49551
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-49551.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2022-49551
- Upstream
- Published
- 2025-02-26T07:01:30Z
- Modified
- 2025-09-19T06:03:19Z
- Summary
- [none]
- Details
-
In the Linux kernel, the following vulnerability has been resolved: usb: isp1760: Fix out-of-bounds array access Running the driver through kasan gives an interesting splat: BUG: KASAN: global-out-of-bounds in isp1760register+0x180/0x70c Read of size 20 at addr f1db2e64 by task swapper/0/1 (...) isp1760register from isp1760platprobe+0x1d8/0x220 (...) This happens because the loop reading the regmap fields for the different ISP1760 variants look like this: for (i = 0; i < HCFIELDMAX; i++) { ... } Meaning it expects the arrays to be at least HCFIELDMAX - 1 long. However the arrays isp1760hcregfields[], isp1763hcregfields[], isp1763hcvolatileranges[] and isp1763dcvolatileranges[] are dynamically sized during compilation. Fix this by putting an empty assignment to the [HCFIELDMAX] and [DCFIELDMAX] array member at the end of each array. This will make the array one member longer than it needs to be, but avoids the risk of overwriting whatever is inside [HCFIELDMAX - 1] and is simple and intuitive to read. Also add comments explaining what is going on.
- References
Affected packages
Debian:12 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:13 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source
Debian:14 / linux
Package
- Name
- linux
- Purl
- pkg:deb/debian/linux?arch=source