CVE-2022-49478
Published: 26 February 2025
Description
In the Linux kernel, the following vulnerability has been resolved: media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Syzbot reported that -1 is used as array index. The problem was in missing validation check. hdw->unit_number is initialized with -1 and then if init table walk fails this value remains unchanged. Since code blindly uses this member for array indexing adding sanity check is the easiest fix for that. hdw->workpoll initialization moved upper to prevent warning in __flush_work.
Security Summary
CVE-2022-49478 is an array-index-out-of-bounds vulnerability in the Linux kernel's pvrusb2 media driver, specifically within the pvr2_i2c_core_init function. The issue stems from a missing validation check on hdw->unit_number, which is initialized to -1 and remains unchanged if the initialization table walk fails, allowing this invalid value to be used directly as an array index. This flaw, reported by Syzbot, is classified under CWE-129 (Improper Validation of Array Index).
A local attacker with low privileges can exploit this vulnerability given its low attack complexity and lack of user interaction requirements (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base score 7.8). Exploitation could enable high-impact confidentiality, integrity, and availability violations, potentially leading to arbitrary code execution, data corruption, or system crashes on affected systems with the vulnerable pvrusb2 driver loaded.
Mitigation is addressed in Linux kernel stable releases via the referenced commits, which introduce a sanity check on hdw->unit_number prior to its use for array indexing—the simplest and most direct fix. The commits also relocate hdw->workpoll initialization earlier in the code to avoid a warning during __flush_work. Security practitioners should ensure systems apply these upstream stable patches, particularly those using pvrusb2 hardware support.
Details
- CWE(s)