Riskcovery

CVE-2022-48866

HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

State
Published
Severity
Not scored
Published
Jul 16, 2024
Updated
May 11, 2026
Reserved
Jul 16, 2024

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts

Syzbot reported an slab-out-of-bounds Read in thrustmaster_probe() bug. The root case is in missing validation check of actual number of endpoints.

Code should not blindly access usb_host_interface::endpoint array, since it may contain less endpoints than code expects.

Fix it by adding missing validaion check and print an error if number of endpoints do not match expected number

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • c49c33637802a2c6957a78119eb8be3b055dd9e9 to before 3ffbe85cda7f523dad896bae08cecd8db8b555abAffected
  • c49c33637802a2c6957a78119eb8be3b055dd9e9 to before 56185434e1e50acecee56d8f5850135009b87947Affected
  • c49c33637802a2c6957a78119eb8be3b055dd9e9 to before fc3ef2e3297b3c0e2006b5d7b3d66965e3392036Affected
LinuxLinux
  • 5.13Affected
  • before 5.13Not affected
  • 5.15.29 through 5.15.*Not affected
  • 5.16.15 through 5.16.*Not affected
  • 5.17 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.