CVE-2022-49032

iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw

State: Published
Severity: Not scored
Published: Oct 21, 2024
Updated: May 11, 2026
Reserved: Aug 22, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw

KASAN report out-of-bounds read as follows:

BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278

Call Trace: afe4404_read_raw iio_read_channel_info dev_attr_show

The buggy address belongs to the variable: afe4404_channel_leds+0x18/0xffffffffffffe9c0

This issue can be reproduce by singe command:

$ cat /sys/bus/i2c/devices/0-0058/iio\:device0/in_intensity6_raw

The array size of afe4404_channel_leds and afe4404_channel_offdacs are less than channels, so access with chan->address cause OOB read in afe4404_[read|write]_raw. Fix it by moving access before use them.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b36e8257641a043764c62240316610c81e36376c to before 68de7da092f38395dde523f2e5db26eba6c23e28Affected b36e8257641a043764c62240316610c81e36376c to before 113c08030a89aaf406f8a1d4549d758a67c2afbaAffected b36e8257641a043764c62240316610c81e36376c to before f5575041ec15310bdc50c42b8b22118cc900226eAffected b36e8257641a043764c62240316610c81e36376c to before 3f566b626029ca8598d48e5074e56bb37399ca1bAffected b36e8257641a043764c62240316610c81e36376c to before 5eb114f55b37dbc0487aa9c1913b81bb7837f1c4Affected b36e8257641a043764c62240316610c81e36376c to before f7419fc42afc035f6b29ce713e17dcd2000c833fAffected b36e8257641a043764c62240316610c81e36376c to before d45d9f45e7b1365fd0d9bf14680d6d5082a590d1Affected b36e8257641a043764c62240316610c81e36376c to before fc92d9e3de0b2d30a3ccc08048a5fad533e4672bAffected
LinuxLinux	4.8Affected before 4.8Not affected 4.9.335 through 4.9.Not affected 4.14.301 through 4.14.Not affected 4.19.268 through 4.19.Not affected 5.4.226 through 5.4.Not affected 5.10.158 through 5.10.Not affected 5.15.82 through 5.15.Not affected 6.0.12 through 6.0.*Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

b36e8257641a043764c62240316610c81e36376c to before 68de7da092f38395dde523f2e5db26eba6c23e28Affected
b36e8257641a043764c62240316610c81e36376c to before 113c08030a89aaf406f8a1d4549d758a67c2afbaAffected
b36e8257641a043764c62240316610c81e36376c to before f5575041ec15310bdc50c42b8b22118cc900226eAffected
b36e8257641a043764c62240316610c81e36376c to before 3f566b626029ca8598d48e5074e56bb37399ca1bAffected
b36e8257641a043764c62240316610c81e36376c to before 5eb114f55b37dbc0487aa9c1913b81bb7837f1c4Affected
b36e8257641a043764c62240316610c81e36376c to before f7419fc42afc035f6b29ce713e17dcd2000c833fAffected
b36e8257641a043764c62240316610c81e36376c to before d45d9f45e7b1365fd0d9bf14680d6d5082a590d1Affected
b36e8257641a043764c62240316610c81e36376c to before fc92d9e3de0b2d30a3ccc08048a5fad533e4672bAffected

LinuxLinux

4.8Affected
before 4.8Not affected
4.9.335 through 4.9.*Not affected
4.14.301 through 4.14.*Not affected
4.19.268 through 4.19.*Not affected
5.4.226 through 5.4.*Not affected
5.10.158 through 5.10.*Not affected
5.15.82 through 5.15.*Not affected
6.0.12 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.