PT-2023-9436 · Linux+4 · Linux Kernel+4
Krzysztof Kozlowski
·
Published
2023-01-09
·
Updated
2025-09-29
·
CVE-2022-48871
CVSS v3.1
7.1
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions prior to 6.1.0-rt5-00350-gb2450b7e00be-dirty #26
Description
The vulnerability is related to a slab-out-of-bounds issue in the
handle rx uart function of the qcom-geni-serial driver. This occurs when the RX FIFO depth is updated after the probe, causing the RX UART handle code to read beyond the bounds of the port->rx fifo buffer. The issue can be observed in certain configurations with Qualcomm Bluetooth HCI UART devices and KASAN.Technical details about exploitation include:
- The
qcom geni serial port setupfunction updates the RX FIFO depth (port->rx fifo depth) to match real device capabilities. - The RX UART handle code reads
port->rx fifo depthnumber of words into theport->rx fifobuffer, thus exceeding the bounds. - Vulnerable function names include
handle rx uart,qcom geni serial handle rx, andqcom geni serial isr.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
NULL Pointer Dereference
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linux Kernel
Red Os
Suse