CVE-2022-48871

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer

Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on

default RX FIFO depth, e.g. 16. Later during serial startup the

qcom_geni_serial_port_setup() updates the RX FIFO depth

(port->rx_fifo_depth) to match real device capabilities, e.g. to 32.

The RX UART handle code will read "port->rx_fifo_depth" number of words

into "port->rx_fifo" buffer, thus exceeding the bounds. This can be

observed in certain configurations with Qualcomm Bluetooth HCI UART

device and KASAN:

Bluetooth: hci0: QCA Product ID :0x00000010

Bluetooth: hci0: QCA SOC Version :0x400a0200

Bluetooth: hci0: QCA ROM Version :0x00000200

Bluetooth: hci0: QCA Patch Version:0x00000d2b

Bluetooth: hci0: QCA controller version 0x02000200

Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv

bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with e

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References