PT-2022-7025 · Linux+3 · Linux Kernel+3

Dongliang Mu · Published 2022-06-09 · Updated 2023-08-14 · CVE-2022-3577

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds memory write flaw was found in the Linux kernel’s Kid-friendly Wired Controller driver, allowing a local user to crash or potentially escalate their privileges on the system. The issue is located in the bigben probe function of drivers/hid/hid-bigbenff.c and is caused by an incorrect assumption that all bigben devices have inputs, which can be broken by malicious devices, leading to an out-of-bounds write.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Memory Leak

Weakness Enumeration

CWE-787

CWE-401

Related Identifiers

ALT-PU-2022-2022

ALT-PU-2022-2023

ALT-PU-2022-2033

ALT-PU-2022-2050

ALT-PU-2022-2052

ALT-PU-2022-2054

ALT-PU-2022-2067

ALT-PU-2022-2099

ALT-PU-2022-2136

ALT-PU-2022-2137

ALT-PU-2022-2152

ALT-PU-2022-2155

ALT-PU-2022-2158

ALT-PU-2022-2261

ALT-PU-2022-2426

ALT-PU-2023-4894

BDU:2023-06664

CVE-2022-3577

OESA-2022-2033

OPENSUSE-SU-2022_3897-1

OPENSUSE-SU-2022_3998-1

OPENSUSE-SU-2022_4053-1

OPENSUSE-SU-2022_4072-1

OPENSUSE-SU-2022_4617-1

SUSE-SU-2022:3897-1

SUSE-SU-2022:3929-1

SUSE-SU-2022:3998-1

SUSE-SU-2022:4053-1

SUSE-SU-2022:4072-1

SUSE-SU-2022:4513-1

SUSE-SU-2022:4515-1

SUSE-SU-2022:4528-1

SUSE-SU-2022:4534-1

SUSE-SU-2022:4562-1

SUSE-SU-2022:4569-1

SUSE-SU-2022:4580-1

SUSE-SU-2022:4587-1

SUSE-SU-2022:4589-1

SUSE-SU-2022:4614-1

SUSE-SU-2022:4617-1

Affected Products

Alt Linux

Astra Linux

Linux Kernel

Suse

References · 526

• https://nvd.nist.gov/vuln/detail/CVE-2022-3594 · Security Note
• https://wiki.astralinux.ru/astra-linux-se81-bulletin-20241206SE81 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3929-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4569-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4053-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3897-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3567 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:4528-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3521 · Security Note
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=945a9a8e448b65bec055d37eba58f711b39f66f0 · Vendor Advisory
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=fc4ef9d5724973193bfa5ebed181dba6de3a56db · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4617-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3577 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2022-2033 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4562-1 · Vendor Advisory