Buffer overflow in Linux
CVE-2022-48696
In the Linux kernel, the following vulnerability has been resolved: regmap: spi: Reserve space for register address/padding Currently the max_raw_read and max_raw_write limits in regmap_spi struct do not take into account the additional size of the transmitted register address and padding. This may result in exceeding the maximum permitted SPI message size, which could cause undefined behaviour, e.g. data corruption. Fix regmap_get_spi_bus() to properly adjust the above mentioned limits by reserving space for the register address/padding as set in the regmap configuration.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (9.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.
Affected products
- Linux — versions f231ff38b7b23197013b437128d196710fe282da, 5.16, 0
- Linux Linux_kernel — versions 6.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2022-48696?
- CVE-2022-48696 is a high-severity vulnerability in Linux, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.1/10. Published 2024-05-03.
- How severe is CVE-2022-48696?
- High severity. CVSS v3 base score is 7.1 out of 10.
- Is CVE-2022-48696 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.