CVE-2022-48672

of: fdt: fix off-by-one error in unflatten_dt_nodes()

State: Published
Severity: Not scored
Published: May 3, 2024
Updated: May 11, 2026
Reserved: Feb 25, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

of: fdt: fix off-by-one error in unflatten_dt_nodes()

Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflatten_dt_nodes() which makes it possible to overflow the nps[] buffer...

Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before cbdda20ce363356698835185801a58a28f644853Affected 78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before 2566706ac6393386a4e7c4ce23fe17f4c98d9aa0Affected 78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before e0e88c25f88b9805572263c9ed20f1d88742feafAffected 78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before ee4369260e77821602102dcc7d792de39a56365cAffected 78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before ba6b9f7cc1108bad6e2c53b1d6e0156379188db7Affected 78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before 2133f451311671c7c42b5640d2b999326b39aa0eAffected 78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before 2f945a792f67815abca26fa8a5e863ccf3fa1181Affected
LinuxLinux	4.7Affected before 4.7Not affected 4.14.295 through 4.14.Not affected 4.19.260 through 4.19.Not affected 5.4.215 through 5.4.Not affected 5.10.145 through 5.10.Not affected 5.15.70 through 5.15.Not affected 5.19.11 through 5.19.Not affected 6.0 and laterNot affected

Product

Versions

LinuxLinux

78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before cbdda20ce363356698835185801a58a28f644853Affected
78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before 2566706ac6393386a4e7c4ce23fe17f4c98d9aa0Affected
78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before e0e88c25f88b9805572263c9ed20f1d88742feafAffected
78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before ee4369260e77821602102dcc7d792de39a56365cAffected
78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before ba6b9f7cc1108bad6e2c53b1d6e0156379188db7Affected
78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before 2133f451311671c7c42b5640d2b999326b39aa0eAffected
78c44d910d3e5f96dc6b3695fc1e4efd7c46a455 to before 2f945a792f67815abca26fa8a5e863ccf3fa1181Affected

LinuxLinux

4.7Affected
before 4.7Not affected
4.14.295 through 4.14.*Not affected
4.19.260 through 4.19.*Not affected
5.4.215 through 5.4.*Not affected
5.10.145 through 5.10.*Not affected
5.15.70 through 5.15.*Not affected
5.19.11 through 5.19.*Not affected
6.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.