CVE-2022-49945

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hwmon: (gpio-fan) Fix array out of bounds access

The driver does not check if the cooling state passed to

gpio_fan_set_cur_state() exceeds the maximum cooling state as

stored in fan_data->num_speeds. Since the cooling state is later

used as an array index in set_fan_speed(), an array out of bounds

access can occur.

This can be exploited by setting the state of the thermal cooling device

to arbitrary values, causing for example a kernel oops when unavailable

memory is accessed this way.

Example kernel oops:

[ 807.987276] Unable to handle kernel paging request at virtual address ffffff80d0588064

[ 807.987369] Mem abort info:

[ 807.987398] ESR = 0x96000005

[ 807.987428] EC = 0x25: DABT (current EL), IL = 32 bits

[ 807.987477] SET = 0, FnV = 0

[ 807.987507] EA = 0, S1PTW = 0

[ 807.987536] FSC = 0x05: level 1 translation fault

[ 807.987570] Data abort info:

[ 807.987763] ISV = 0, ISS = 0x00000005

[

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References