CVE-2022-48938
CDC-NCM: avoid overflow in sanity checking
Summary
CDC-NCM: avoid overflow in sanity checking
Original description
The description as published by the source.
In the Linux kernel, the following vulnerability has been resolved:
CDC-NCM: avoid overflow in sanity checking
A broken device may give an extreme offset like 0xFFF0
and a reasonable length for a fragment. In the sanity
check as formulated now, this will create an integer
overflow, defeating the sanity check. Both offset
and offset + len need to be checked in such a manner
that no overflow can occur.
And those quantities should be unsigned.
Affected packages
Linux
Kernel
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.19.323"}]},{"type":"ECOSYSTEM","events":[{"introduced":"4.20.0"},{"fixed":"5.4.285"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.5.0"},{"fixed":"5.10.103"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.7.0"},{"fixed":"5.15.26"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.16.12"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-48938 linux Fixed in: 5.10.103-1
- Ubuntu UBUNTU-CVE-2022-48938 linux-aws Fixed in: 4.4.0-1138.144
References
- advisory github.com
- advisory nvd.nist.gov
- package git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org
- web git.kernel.org