CVE-2022-48806: 
Linux Kernel vulnerability analysis and mitigation

CVE-2022-48806 affects the Linux kernel's EEPROM driver (ee1004). The vulnerability was discovered when commit effa453168a7 revealed that ee1004_eeprom_read() did not properly limit how many bytes to read at once. The issue was disclosed on July 16, 2024 (NVD).

The vulnerability stems from i2c_smbus_read_i2c_block_data_or_emulated() taking the length to read as a u8 data type. If count equals 256 after taking into account the offset and page boundary, the cast to u8 overflows. This commonly occurs when userspace attempts to read the entire EEPROM at once (Kernel Commit).

When exploited, this vulnerability could lead to a buffer overflow condition when reading from the EEPROM device, potentially causing system instability or crashes (NVD).

The vulnerability can be triggered when userspace applications attempt to read the entire EEPROM at once, making it a relatively common occurrence under normal usage patterns (Kernel Commit).

The issue has been fixed by limiting each read to I2C_SMBUS_BLOCK_MAX (32) bytes, which is already the maximum length that i2c_smbus_read_i2c_block_data_or_emulated() allows. The fix has been implemented in the Linux kernel through a patch (Kernel Commit).