CVE-2022-49031

iio: health: afe4403: Fix oob read in afe4403_read_raw

State: Published
Severity: Not scored
Published: Oct 21, 2024
Updated: May 11, 2026
Reserved: Aug 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: health: afe4403: Fix oob read in afe4403_read_raw

KASAN report out-of-bounds read as follows:

BUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0 Read of size 4 at addr ffffffffc02ac638 by task cat/279

Call Trace: afe4403_read_raw iio_read_channel_info dev_attr_show

The buggy address belongs to the variable: afe4403_channel_leds+0x18/0xffffffffffffe9e0

This issue can be reproduced by singe command:

$ cat /sys/bus/spi/devices/spi0.0/iio\:device0/in_intensity6_raw

The array size of afe4403_channel_leds is less than channels, so access with chan->address cause OOB read in afe4403_read_raw. Fix it by moving access before use it.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b36e8257641a043764c62240316610c81e36376c to before 98afcb5f3be645d330c74c5194ba0d80e26f95e0Affected b36e8257641a043764c62240316610c81e36376c to before c9268df36818ee4eaaaeadc80009b442a5ca69c9Affected b36e8257641a043764c62240316610c81e36376c to before 726fa3e4ab97dcff1c745bdc4fb137366cb8d3dfAffected b36e8257641a043764c62240316610c81e36376c to before 2d6a437064ffbe685c67ddb16dfc0946074c6c3fAffected b36e8257641a043764c62240316610c81e36376c to before b1756af172fb80a3edc143772d49e166ec691b6cAffected b36e8257641a043764c62240316610c81e36376c to before e7e76a77aabef8989cbc0a8417af1aa040620867Affected b36e8257641a043764c62240316610c81e36376c to before 06c6ce21cec77dfa860d57e7a006000a57812efbAffected b36e8257641a043764c62240316610c81e36376c to before 58143c1ed5882c138a3cd2251a336fc8755f23d9Affected
LinuxLinux	4.8Affected before 4.8Not affected 4.9.335 through 4.9.Not affected 4.14.301 through 4.14.Not affected 4.19.268 through 4.19.Not affected 5.4.226 through 5.4.Not affected 5.10.158 through 5.10.Not affected 5.15.82 through 5.15.Not affected 6.0.12 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

b36e8257641a043764c62240316610c81e36376c to before 98afcb5f3be645d330c74c5194ba0d80e26f95e0Affected
b36e8257641a043764c62240316610c81e36376c to before c9268df36818ee4eaaaeadc80009b442a5ca69c9Affected
b36e8257641a043764c62240316610c81e36376c to before 726fa3e4ab97dcff1c745bdc4fb137366cb8d3dfAffected
b36e8257641a043764c62240316610c81e36376c to before 2d6a437064ffbe685c67ddb16dfc0946074c6c3fAffected
b36e8257641a043764c62240316610c81e36376c to before b1756af172fb80a3edc143772d49e166ec691b6cAffected
b36e8257641a043764c62240316610c81e36376c to before e7e76a77aabef8989cbc0a8417af1aa040620867Affected
b36e8257641a043764c62240316610c81e36376c to before 06c6ce21cec77dfa860d57e7a006000a57812efbAffected
b36e8257641a043764c62240316610c81e36376c to before 58143c1ed5882c138a3cd2251a336fc8755f23d9Affected

LinuxLinux

4.8Affected
before 4.8Not affected
4.9.335 through 4.9.*Not affected
4.14.301 through 4.14.*Not affected
4.19.268 through 4.19.*Not affected
5.4.226 through 5.4.*Not affected
5.10.158 through 5.10.*Not affected
5.15.82 through 5.15.*Not affected
6.0.12 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.