CyberSecBulletin
CVE-2022-48951NVD status: Analyzed

Linux: Out-of-bounds Write

Published Updated By the CyberSecBulletin desk

CVE-2022-48951 is a high-severity out-of-bounds write vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 56288987843c3cb343e81e5fa51549cbaf541bd0, cf1c225f1927891ae388562b78ced7840c3723b9, 18a168d85eadcfd45f015b5ecd2a97801b959e43 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.24% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 56288987843c3cb343e81e5fa51549cbaf541bd0 or cf1c225f1927891ae388562b78ced7840c3723b9 or 18a168d85eadcfd45f015b5ecd2a97801b959e43 or 9796d07c753164b7e6b0d7ef23fb4482840a9ef8, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.9.337 or 4.14.303 or 4.19.270 or 5.4.228, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9e5c40b5706d8aae2cf70bd7e01f0b4575a642d0 up to, but not including, 56288987843c3cb343e81e5fa51549cbaf541bd0; 4977491e4b3aad8567f57e2a9992d251410c1db3 up to, but not including, cf1c225f1927891ae388562b78ced7840c3723b9; 9a12fcbf3c622f9bf6b110a873d62b0cba93972e up to, but not including, 18a168d85eadcfd45f015b5ecd2a97801b959e43; c33402b056de61104b6146dedbe138ca8d7ec62b up to, but not including, 9796d07c753164b7e6b0d7ef23fb4482840a9ef8; 038f8b7caa74d29e020949a43ca368c93f6b29b9 up to, but not including, 50b5f6d4d9d2d69a7498c44fd8b26e13d73d3d98; e8e07c5e25a29e2a6f119fd947f55d7a55eb8a13 up to, but not including, cf611d786796ec33da09d8c83d7d7f4e557b27de; 4f1e50d6a9cf9c1b8c859d449b5031cacfa8404e up to, but not including, 1798b62d642e7b3d4ea3403914c3caf4e438465d; 4f1e50d6a9cf9c1b8c859d449b5031cacfa8404e up to, but not including, 97eea946b93961fffd29448dcda7398d0d51c4b2; and 9 more ranges56288987843c3cb343e81e5fa51549cbaf541bd0, cf1c225f1927891ae388562b78ced7840c3723b9, 18a168d85eadcfd45f015b5ecd2a97801b959e43, 9796d07c753164b7e6b0d7ef23fb4482840a9ef8, 50b5f6d4d9d2d69a7498c44fd8b26e13d73d3d98, cf611d786796ec33da09d8c83d7d7f4e557b27de
LinuxLinux Kernelbefore 4.9.337; 4.10 up to, but not including, 4.14.303; 4.15 up to, but not including, 4.19.270; 4.20 up to, but not including, 5.4.228; 5.5 up to, but not including, 5.10.160; 5.11 up to, but not including, 5.15.84; 5.16 up to, but not including, 6.0.14; 6.14.9.337, 4.14.303, 4.19.270, 5.4.228, 5.10.160, 5.15.84

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Check bounds for second channel in snd_soc_put_volsw_sx() The bounds checks in snd_soc_put_volsw_sx() are only being applied to the first channel, meaning it is possible to write out of bounds values to the second channel in stereo controls. Add appropriate checks.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega, and the Strsafe.h library from Microsoft. These libraries provide safer versions of overflow-prone string-handling functions.
  • Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index checking. D3-SFCV (Stack Frame Canary Validation) from D3FEND discusses canary-based detection in detail.

More Out-of-bounds Write vulnerabilities (CWE-787)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Write vulnerabilities

Spotted an error? Tell us.