Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2022-48806

eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size") revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once. In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the length to read as an u8. If count == 256 after taking into account the offset and page boundary, the cast to u8 overflows. And this is common when user space tries to read the entire EEPROM at once. To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • aca56c298e2a6d20ab6308e203a8d37f2a7759d3 to < 3937c35493ee2847aaefcfa5460e94b7443eef49affected
  • 25714ad6bf5e98025579fa4c08ff2041a663910c to < a37960df7eac3cc8094bd1ab84864e9e32c91345affected
  • be9313f755a7bfa02230b15731d07074d5255ecb to < 9a5f471ae380f9fcb9756d453c12ca1f8595a93caffected
  • 07d9beb6e3c2e852e884113d6803ea4b3643ae38 to < 9443ddeb3754e9e382a396b50adc1961301713ceaffected
  • effa453168a7eeb8a562ff4edc1dbf9067360a61 to < c0689e46be23160d925dca95dfc411f1a0462708affected
  • 74650c34f93044d3ab441235f161f9e1e761e96baffected
  • a126a8c3dd51519513141b4fc94fd4813bca2c0faffected
  • 202d0e22fe512df0f1cb6253d40ce1058e373247affected
  • 7414af7bdad9a9cddb3a765ca98ea207048618c5affected
  • 4.4.300 to < 4.5affected
  • 4.9.298 to < 4.10affected
  • 4.14.263 to < 4.15affected
  • 4.19.226 to < 4.20affected

Linux Linux

Default version status: unaffected

  • 5.4.174 to < 5.4.180affected
  • 5.10.94 to < 5.10.101affected
  • 5.15.17 to < 5.15.24affected
  • 5.16.3 to < 5.16.10affected

References