Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-48806
CVE-2022-48806:
Linux Kernel vulnerability analysis and mitigation
Overview
CVE-2022-48806 affects the Linux kernel's EEPROM driver (ee1004). The vulnerability was discovered when commit effa453168a7 revealed that ee1004eepromread() did not properly limit how many bytes to read at once. The issue was disclosed on July 16, 2024 (NVD).
Technical details
The vulnerability stems from i2csmbusreadi2cblockdataor_emulated() taking the length to read as a u8 data type. If count equals 256 after taking into account the offset and page boundary, the cast to u8 overflows. This commonly occurs when userspace attempts to read the entire EEPROM at once (Kernel Commit).
Impact
When exploited, this vulnerability could lead to a buffer overflow condition when reading from the EEPROM device, potentially causing system instability or crashes (NVD).
Mitigation and workarounds
The issue has been fixed by limiting each read to I2CSMBUSBLOCKMAX (32) bytes, which is already the maximum length that i2csmbusreadi2cblockdataoremulated() allows. The fix has been implemented in the Linux kernel through a patch (Kernel Commit).
Additional resources
Source: This report was generated using AI
Related Linux Kernel vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management