CVE-2022-48739: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48739 affects the Linux kernel's ASoC (ALSA System on Chip) HDMI codec driver. The vulnerability involves an out-of-bounds memory access issue in the hdmi-codec driver. The issue was discovered when KASAN (Kernel Address Sanitizer) reported out-of-bounds slab read accesses made by memcpy() operations (NVD).

The vulnerability stems from an incorrect size definition of the iecstatus array in the hdmi-codec driver. The array was initially defined with a size of 5 bytes, while it should match the size of the status array in the struct sndaes_iec958, which is 24 bytes. This mismatch led to out-of-bounds memory reads during memcpy operations. The issue has been assigned a CVSS v3.1 base score of 7.1 HIGH with vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (NVD).

The vulnerability allows an attacker to perform out-of-bounds slab read accesses, potentially leading to information disclosure and system crashes. The CVSS score indicates high impacts on confidentiality and availability, though no impact on integrity has been noted (NVD).

The vulnerability has been patched by correcting the size of the iecstatus array to match AESIEC958STATUSSIZE (24 bytes). The fix involves modifying both the HDMI codec driver and the ALSA sound header files. The patch has been merged into the Linux kernel (Kernel Patch).