Buffer overflow in Linux

CVE-2022-48696

In the Linux kernel, the following vulnerability has been resolved: regmap: spi: Reserve space for register address/padding Currently the max_raw_read and max_raw_write limits in regmap_spi struct do not take into account the additional size of the transmitted register address and padding. This may result in exceeding the maximum permitted SPI message size, which could cause undefined behaviour, e.g. data corruption. Fix regmap_get_spi_bus() to properly adjust the above mentioned limits by reserving space for the register address/padding as set in the regmap configuration.

Vulnerability class: Buffer Overflow

Published · last modified .

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H.

EPSS exploit prediction

EPSS: 0.002 (8.5th percentile), scored .

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 8th percentile — 8.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2022-48696: held from 0.002 to 0.002.

EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000

Affected products

  • Linux — versions f231ff38b7b23197013b437128d196710fe282da, 5.16, 0
  • Linux Kernel — versions 6.0

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2022-48696?
CVE-2022-48696 is a high-severity vulnerability in Linux, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 7.1/10. Published 2024-05-03.
How severe is CVE-2022-48696?
High severity. CVSS v3 base score is 7.1 out of 10.
Is CVE-2022-48696 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.