usb: gadget: uvc: Prevent buffer overflow in setup handler

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• linux linux kernel2.6.35 and later · before 4.9.337
• linux linux kernel4.10 and later · before 4.14.303
• linux linux kernel4.15 and later · before 4.19.270
• linux linux kernel4.20 and later · before 5.4.229
• linux linux kernel5.5 and later · before 5.10.161
• linux linux kernel5.11 and later · before 5.15.85
• linux linux kernel5.16 and later · before 6.0.15
• linux linux kernel6.1

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 2.6.35affected
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before 4972e3528b968665b596b5434764ff8fd9446d35affected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before 06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5affected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before bc8380fe5768c564f921f7b4eaba932e330b9e4baffected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before b8fb1cba934ea122b50f13a4f9d6fc4fdc43d2beaffected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before c79538f32df12887f110dcd6b9c825b482905f24affected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before 6b41a35b41f77821db24f2d8f66794b390a585c5affected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before 7b1f773277a72f9756d47a41b94e43506cce1954affected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before d1a92bb8d697f170d93fe922da763d7d156b8841affected · git
  • cdda479f15cd13fa50a913ca85129c0437cc7b91 and later · before 4c92670b16727365699fe4b19ed32013bab2c107affected · git

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now
• CVE-2016-5195Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect haKEV
  83Now

Published before and after this one in the same product

• ← EarlierCVE-2022-48946Oct 21, 2024 · udf: Fix preallocation discarding at indirect extent boundary
  22Monitor
• ← EarlierCVE-2022-48947Oct 21, 2024 · Bluetooth: L2CAP: Fix u8 overflow
  22Monitor
• Later →CVE-2022-48949Oct 21, 2024 · igb: Initialize mailbox message for VF reset
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.