vulnerability
Ubuntu: (CVE-2022-49226): linux vulnerability
Severity | CVSS | Published | Added | Modified |
---|---|---|---|---|
5 | (AV:L/AC:L/Au:S/C:C/I:N/A:N) | Feb 26, 2025 | Mar 19, 2025 | Jun 12, 2025 |
Description
In the Linux kernel, the following vulnerability has been resolved:
net: asix: add proper error handling of usb read errors
Syzbot once again hit uninit value in asix driver. The problem still the
same -- asix_read_cmd() reads less bytes, than was requested by caller.
Since all read requests are performed via asix_read_cmd() let's catch
usb related error there and add __must_check notation to be sure all
callers actually check return value.
So, this patch adds sanity check inside asix_read_cmd(), that simply
checks if bytes read are not less, than was requested and adds missing
error handling of asix_read_cmd() all across the driver code.
Solution(s)
References
- CVE-2022-49226
- https://attackerkb.com/topics/CVE-2022-49226
- URL-https://git.kernel.org/linus/920a9fa27e7805499cfe78491b36fed2322c02ec
- URL-https://git.kernel.org/stable/c/662ff765470ad0d11a1153d6d8e99d69a98e60b4
- URL-https://git.kernel.org/stable/c/920a9fa27e7805499cfe78491b36fed2322c02ec
- URL-https://git.kernel.org/stable/c/9ea8d2fca8fea3b17005b4dc02f8ef15f7a2fb97
- URL-https://git.kernel.org/stable/c/b96a7265f763b37ff3138b9ca8122a950f13b00e
- URL-https://www.cve.org/CVERecord?id=CVE-2022-49226

Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.