CVE-2022-50778

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL

With CONFIG_FORTIFY=y and CONFIG_UBSAN_LOCAL_BOUNDS=y enabled, we observe

a runtime panic while running Android's Compatibility Test Suite's (CTS)

android.hardware.input.cts.tests. This is stemming from a strlen()

call in hidinput_allocate().

__compiletime_strlen() is implemented in terms of __builtin_object_size(),

then does an array access to check for NUL-termination. A quirk of

__builtin_object_size() is that for strings whose values are runtime

dependent, __builtin_object_size(str, 1 or 0) returns the maximum size

of possible values when those sizes are determinable at compile time.

Example:

static const char *v = "FOO BAR";

static const char *y = "FOO BA";

unsigned long x (int z) {

// Returns 8, which is:

// max(__builtin_object_size(v, 1), __builtin_object_size(y, 1))

return __builtin_object_size(z ? v : y, 1);

}

So when

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References