{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2022-48871","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-07-16T11:38:08.921Z","datePublished":"2024-08-21T06:10:01.859Z","dateUpdated":"2026-08-05T08:52:41.934Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T08:52:41.934Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer\n\nDriver's probe allocates memory for RX FIFO (port->rx_fifo) based on\ndefault RX FIFO depth, e.g. 16.  Later during serial startup the\nqcom_geni_serial_port_setup() updates the RX FIFO depth\n(port->rx_fifo_depth) to match real device capabilities, e.g. to 32.\n\nThe RX UART handle code will read \"port->rx_fifo_depth\" number of words\ninto \"port->rx_fifo\" buffer, thus exceeding the bounds.  This can be\nobserved in certain configurations with Qualcomm Bluetooth HCI UART\ndevice and KASAN:\n\n  Bluetooth: hci0: QCA Product ID   :0x00000010\n  Bluetooth: hci0: QCA SOC Version  :0x400a0200\n  Bluetooth: hci0: QCA ROM Version  :0x00000200\n  Bluetooth: hci0: QCA Patch Version:0x00000d2b\n  Bluetooth: hci0: QCA controller version 0x02000200\n  Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv\n  bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2\n  Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)\n  Bluetooth: hci0: QCA Failed to download patch (-2)\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c\n  Write of size 4 at addr ffff279347d578c0 by task swapper/0/0\n\n  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26\n  Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\n  Call trace:\n   dump_backtrace.part.0+0xe0/0xf0\n   show_stack+0x18/0x40\n   dump_stack_lvl+0x8c/0xb8\n   print_report+0x188/0x488\n   kasan_report+0xb4/0x100\n   __asan_store4+0x80/0xa4\n   handle_rx_uart+0xa8/0x18c\n   qcom_geni_serial_handle_rx+0x84/0x9c\n   qcom_geni_serial_isr+0x24c/0x760\n   __handle_irq_event_percpu+0x108/0x500\n   handle_irq_event+0x6c/0x110\n   handle_fasteoi_irq+0x138/0x2cc\n   generic_handle_domain_irq+0x48/0x64\n\nIf the RX FIFO depth changes after probe, be sure to resize the buffer."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The buggy RX path is exercised on Qualcomm GENI UARTs used as Bluetooth HCI transports (as documented in the fix); an adjacent Bluetooth peer can drive HCI/ACL traffic that fills the UART RX FIFO and triggers the out-of-bounds write without physical serial access.\nAC:L - On affected Qualcomm hardware the FIFO-depth mismatch is a fixed device property after port setup, and sending enough RX data reliably overflows the undersized slab buffer with no race or attacker-uncontrollable condition required.\nPR:N - An adjacent Bluetooth attacker needs no local account or capabilities; the system Bluetooth stack opens the GENI UART, and unauthenticated adjacent RF activity can produce UART RX that hits the vulnerable ISR path.\nUI:N - No victim action is required beyond a normal deployment where Bluetooth/HCI UART is already enabled and the port has been set up by the platform Bluetooth service.\nS:U - The corruption is confined to host kernel heap memory in the same security authority; this is privilege escalation / DoS on the local kernel, not a VM/IOMMU/sandbox boundary crossing.\nC:H - The slab out-of-bounds write of attacker-influenced UART RX bytes into adjacent heap objects is memory corruption that can be leveraged to obtain arbitrary kernel read primitives.\nI:H - Out-of-bounds heap write of controlled RX FIFO contents into neighboring slab objects enables corruption of kernel structures and control-flow hijacking / arbitrary write primitives.\nA:H - The same out-of-bounds write can crash the kernel (as shown by the KASAN slab-out-of-bounds report in softirq/ISR context), yielding a full availability impact."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"versions":[{"version":"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9","lessThan":"894681682dbefdad917b88f86cde1069140a047a","status":"affected","versionType":"git"},{"version":"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9","lessThan":"cb53a3366eb28fed67850c80afa52075bb71a38a","status":"affected","versionType":"git"},{"version":"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9","lessThan":"fd524ca7fe45b8a06dca2dd546d62684a9768f95","status":"affected","versionType":"git"},{"version":"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9","lessThan":"b8caf69a6946e18ffebad49847e258f5b6d52ac2","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/tty/serial/qcom_geni_serial.c"],"versions":[{"version":"5.7","status":"affected"},{"version":"0","lessThan":"5.7","status":"unaffected","versionType":"semver"},{"version":"5.10.165","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.90","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.8","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.10.165"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"5.15.90"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.7","versionEndExcluding":"6.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a"},{"url":"https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a"},{"url":"https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95"},{"url":"https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2"}],"title":"tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2022-48871","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2024-09-10T16:05:28.910017Z"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-12T17:32:54.202Z"}}]}}