CVE-2022-50066

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: atlantic: fix aq_vec index out of range error

The final update statement of the for loop exceeds the array range, the

dereference of self->aq_vec[i] is not checked and then leads to the

index out of range error.

Also fixed this kind of coding style in other for loop.

[ 97.937604] UBSAN: array-index-out-of-bounds in drivers/net/ethernet/aquantia/atlantic/aq_nic.c:1404:48

[ 97.937607] index 8 is out of range for type 'aq_vec_s *[8]'

[ 97.937608] CPU: 38 PID: 3767 Comm: kworker/u256:18 Not tainted 5.19.0+ #2

[ 97.937610] Hardware name: Dell Inc. Precision 7865 Tower/, BIOS 1.0.0 06/12/2022

[ 97.937611] Workqueue: events_unbound async_run_entry_fn

[ 97.937616] Call Trace:

[ 97.937617] <TASK>

[ 97.937619] dump_stack_lvl+0x49/0x63

[ 97.937624] dump_stack+0x10/0x16

[ 97.937626] ubsan_epilogue+0x9/0x3f

[ 97.937627] __ubsan_handle_out_of_bounds.cold+0x44/0x49

[ 97.937629] ? __scm_send+0x348

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References