Heap-based Buffer Overflow Affecting kernel-zfcpdump-modules package, versions <0:4.18.0-553.16.1.el8_10
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RHEL8-KERNELZFCPDUMPMODULES-6736918
- published 30 Apr 2024
- disclosed 28 Apr 2024
Introduced: 28 Apr 2024
CVE-2022-48632 Open this link in a new tabHow to fix?
Upgrade RHEL:8 kernel-zfcpdump-modules to version 0:4.18.0-553.16.1.el8_10 or higher.
This issue was patched in RHSA-2024:5101.
NVD Description
Note: Versions mentioned in the description apply only to the upstream kernel-zfcpdump-modules package and not the kernel-zfcpdump-modules package as distributed by RHEL.
See How to fix? for RHEL:8 relevant fixed versions and status.
In the Linux kernel, the following vulnerability has been resolved:
i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments.
References
- https://access.redhat.com/security/cve/CVE-2022-48632
- https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8
- https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e
- https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2
- https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b