PT-2025-53144 · Linux+2 · Linux Kernel+2
Published
2022-09-07
·
Updated
2026-04-20
·
CVE-2022-50778
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
The Linux kernel contains an issue related to the
compiletime strlen() function when used with CONFIG FORTIFY=y and CONFIG UBSAN LOCAL BOUNDS=y. The issue arises from how builtin object size() handles strings with runtime-dependent values, potentially leading to out-of-bounds access during runtime checks. Specifically, the function may attempt to access memory beyond the allocated buffer size in certain scenarios, triggering a runtime panic. This was observed during Android Compatibility Test Suite (CTS) tests. The issue is related to a strlen() call within the hidinput allocate() function. The function uses a local C string whose value depends on a switch statement, causing builtin object size() to evaluate to the maximum string length, leading to the out-of-bounds access.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Android Cts
Debian
Linux Kernel