CVE-2022-50156

In the Linux kernel, the following vulnerability has been resolved:

HID: cp2112: prevent a buffer overflow in cp2112_xfer()

Smatch warnings: drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'data->block[1]' too small (33 vs 255) drivers/hid/hid-cp2112.c:793 cp2112_xfer() error: __memcpy() 'buf' too small (64 vs 255)

The 'read_length' variable is provided by 'data->block[0]' which comes from user and it(read_length) can take a value between 0-255. Add an upper bound to 'read_length' variable to prevent a buffer overflow in memcpy().

This vulnerability is rated as having Moderate severity because exploitation requires local access and the active presence of Silicon Labs CP2112 USB-to-SMBus bridge hardware. An attacker requires local permissions to initiate SMBus transfer requests on the exposed adapter device to trigger memory corruption. Deployments that do not attach or emulate CP2112 devices are not exposed to this flaw under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.