CVE-2022-48632

kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()

Loading…

Severity

Moderate

Red Hat Product Security

4.7

CVSS 3.1

Review impact separately from score.

Published · April 28, 2024

Updated · October 29, 2026

Description

A flaw was found in the Linux kernel. The following vulnerability has been resolved: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction().

Statement

Actual only for ARM platforms. For the Red Hat Enterprise Linux and Fedora the related code disabled, so not affected (apart from the latest version of the Red Hat Enterprise Linux 9 and latest version of the Red Hat Enterprise Linux 10). The bug could happen only if Mellanox BlueField I2C controller being used.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

To mitigate this issue, prevent module i2c-mlxbf from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.

CVSS / CWE

CVSS 3.1 · 4.7
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-122 · Heap-based Buffer Overflow