CVE-2022-49551

Summary

CVE-2022-49551 is a vulnerability in the Linux kernel's usb: isp1760 driver, which has been resolved. The issue involves an out-of-bounds array access during the registration of the driver. This occurs because the loop used to read the regmap fields for different ISP1760 variants expects the arrays to be at least one element longer than they actually are. However, the arrays isp1760_hc_reg_fields[], isp1763_hc_reg_fields[], isp1763_hc_volatile_ranges[], and isp1763_dc_volatile_ranges[] are dynamically sized during compilation. To address this, an empty assignment has been added to the end of each array to make it one member longer than required, thereby avoiding potential overwriting of adjacent memory. This simple and intuitive solution also includes added comments to explain the reasoning behind the fix.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.