cve/published/2022/CVE-2022-48948.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2022-48948: usb: gadget: uvc: Prevent buffer overflow in setup handler

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

usb: gadget: uvc: Prevent buffer overflow in setup handler

Setup function uvc_function_setup permits control transfer
requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),
data stage handler for OUT transfer uses memcpy to copy req->actual
bytes to uvc_event->data.data array of size 60. This may result
in an overflow of 4 bytes.

The Linux kernel CVE team has assigned CVE-2022-48948 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 4.9.337 with commit 4972e3528b968665b596b5434764ff8fd9446d35
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 4.14.303 with commit 06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 4.19.270 with commit bc8380fe5768c564f921f7b4eaba932e330b9e4b
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 5.4.229 with commit b8fb1cba934ea122b50f13a4f9d6fc4fdc43d2be
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 5.10.161 with commit c79538f32df12887f110dcd6b9c825b482905f24
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 5.15.85 with commit 6b41a35b41f77821db24f2d8f66794b390a585c5
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 6.0.15 with commit 7b1f773277a72f9756d47a41b94e43506cce1954
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 6.1.1 with commit d1a92bb8d697f170d93fe922da763d7d156b8841
	Issue introduced in 2.6.35 with commit cdda479f15cd13fa50a913ca85129c0437cc7b91 and fixed in 6.2 with commit 4c92670b16727365699fe4b19ed32013bab2c107

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-48948
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/usb/gadget/function/f_uvc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/4972e3528b968665b596b5434764ff8fd9446d35
	https://git.kernel.org/stable/c/06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5
	https://git.kernel.org/stable/c/bc8380fe5768c564f921f7b4eaba932e330b9e4b
	https://git.kernel.org/stable/c/b8fb1cba934ea122b50f13a4f9d6fc4fdc43d2be
	https://git.kernel.org/stable/c/c79538f32df12887f110dcd6b9c825b482905f24
	https://git.kernel.org/stable/c/6b41a35b41f77821db24f2d8f66794b390a585c5
	https://git.kernel.org/stable/c/7b1f773277a72f9756d47a41b94e43506cce1954
	https://git.kernel.org/stable/c/d1a92bb8d697f170d93fe922da763d7d156b8841
	https://git.kernel.org/stable/c/4c92670b16727365699fe4b19ed32013bab2c107