CVE-2022-48866: HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts
In the Linux kernel, the following vulnerability has been resolved:
HID: hid-thrustmaster: fix OOB read in thrustmasterinterrupts
Syzbot reported an slab-out-of-bounds Read in thrustmasterprobe() bug. The root case is in missing validation check of actual number of endpoints.
Code should not blindly access usbhostinterface::endpoint array, since it may contain less endpoints than code expects.
Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48866?
The severity of CVE-2022-48866 is classified as moderate due to the potential for an out-of-bounds read affecting kernel memory.
How do I fix CVE-2022-48866?
To fix CVE-2022-48866, upgrade your Linux kernel to version 5.15.29, 5.16.15, or 5.17 or later.
What systems are affected by CVE-2022-48866?
CVE-2022-48866 affects Linux kernel versions between 5.13 and 5.15.29, and includes specific versions 5.16.15 and 5.17.
What type of vulnerability is CVE-2022-48866?
CVE-2022-48866 is an out-of-bounds read vulnerability in the Linux kernel's HID subsystem.
Who reported the issue for CVE-2022-48866?
The issue for CVE-2022-48866 was reported by Syzbot, which is a tool designed to detect kernel vulnerabilities.