CyberSecBulletin
CVE-2022-50279NVD status: Analyzed

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2022-50279 is a high-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 7.1 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions fc3442247716fc426bbcf62ed65e086e48a6d44f, 28ea268d95e57cdf6394a058f0d854206d478772, 1e950b9a841bc96e98ee25680d5c7aa305120be1 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to fc3442247716fc426bbcf62ed65e086e48a6d44f or 28ea268d95e57cdf6394a058f0d854206d478772 or 1e950b9a841bc96e98ee25680d5c7aa305120be1 or 0c962dcd6bf64b78eaffc09e497a2beb4e48bc32, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 4.19.276 or 5.4.235 or 5.10.173 or 5.15.99, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux21e4b0726dc671c423e2dc9a85364716219c4502 up to, but not including, fc3442247716fc426bbcf62ed65e086e48a6d44f; 21e4b0726dc671c423e2dc9a85364716219c4502 up to, but not including, 28ea268d95e57cdf6394a058f0d854206d478772; 21e4b0726dc671c423e2dc9a85364716219c4502 up to, but not including, 1e950b9a841bc96e98ee25680d5c7aa305120be1; 21e4b0726dc671c423e2dc9a85364716219c4502 up to, but not including, 0c962dcd6bf64b78eaffc09e497a2beb4e48bc32; 21e4b0726dc671c423e2dc9a85364716219c4502 up to, but not including, f1fe40120de6ad4ffa8299fde035a5feba10d4fb; 21e4b0726dc671c423e2dc9a85364716219c4502 up to, but not including, 057b52461dc005ecd85a3e4998913b1492ec0f72; 21e4b0726dc671c423e2dc9a85364716219c4502 up to, but not including, 117dbeda22ec5ea0918254d03b540ef8b8a64d53; 3.18fc3442247716fc426bbcf62ed65e086e48a6d44f, 28ea268d95e57cdf6394a058f0d854206d478772, 1e950b9a841bc96e98ee25680d5c7aa305120be1, 0c962dcd6bf64b78eaffc09e497a2beb4e48bc32, f1fe40120de6ad4ffa8299fde035a5feba10d4fb, 057b52461dc005ecd85a3e4998913b1492ec0f72
LinuxLinux Kernel3.18 up to, but not including, 4.19.276; 4.20 up to, but not including, 5.4.235; 5.5 up to, but not including, 5.10.173; 5.11 up to, but not including, 5.15.99; 5.16 up to, but not including, 6.1.16; 6.2 up to, but not including, 6.2.34.19.276, 5.4.235, 5.10.173, 5.15.99, 6.1.16, 6.2.3

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
NoneNothing can be modified.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() There is a global-out-of-bounds reported by KASAN: BUG: KASAN: global-out-of-bounds in _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] Read of size 1 at addr ffffffffa0773c43 by task NetworkManager/411 CPU: 6 PID: 411 Comm: NetworkManager Tainted: G D 6.1.0-rc8+ #144 e15588508517267d37 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), Call Trace: <TASK> ... kasan_report+0xbb/0x1c0 _rtl8812ae_eq_n_byte.part.0+0x3d/0x84 [rtl8821ae] rtl8821ae_phy_bb_config.cold+0x346/0x641 [rtl8821ae] rtl8821ae_hw_init+0x1f5e/0x79b0 [rtl8821ae] ... </TASK> The root cause of the problem is that the comparison order of "prate_section" in _rtl8812ae_phy_set_txpower_limit() is wrong. The _rtl8812ae_eq_n_byte() is used to compare the first n bytes of the two strings from tail to head, which causes the problem. In the _rtl8812ae_phy_set_txpower_limit(), it was originally intended to meet this requirement by carefully designing the comparison order. For example, "pregulation" and "pbandwidth" are compared in order of length from small to large, first is 3 and last is 4. However, the comparison order of "prate_section" dose not obey such order requirement, therefore when "prate_section" is "HT", when comparing from tail to head, it will lead to access out of bounds in _rtl8812ae_eq_n_byte(). As mentioned above, the _rtl8812ae_eq_n_byte() has the same function as strcmp(), so just strcmp() is enough. Fix it by removing _rtl8812ae_eq_n_byte() and use strcmp() barely. Although it can be fixed by adjusting the comparison order of "prate_section", this may cause the value of "rate_section" to not be from 0 to 5. In addition, commit "21e4b0726dc6" not only moved driver from staging to regular tree, but also added setting txpower limit function during the driver config phase, so the problem was introduced by this commit.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.