GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48871 (GCVE-0-2022-48871)

Vulnerability from cvelistv5 – Published: 2024-08-21 06:10 – Updated: 2026-08-05 08:52
VLAI
Title
tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer
Summary
In the Linux kernel, the following vulnerability has been resolved: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer Driver's probe allocates memory for RX FIFO (port->rx_fifo) based on default RX FIFO depth, e.g. 16. Later during serial startup the qcom_geni_serial_port_setup() updates the RX FIFO depth (port->rx_fifo_depth) to match real device capabilities, e.g. to 32. The RX UART handle code will read "port->rx_fifo_depth" number of words into "port->rx_fifo" buffer, thus exceeding the bounds. This can be observed in certain configurations with Qualcomm Bluetooth HCI UART device and KASAN: Bluetooth: hci0: QCA Product ID :0x00000010 Bluetooth: hci0: QCA SOC Version :0x400a0200 Bluetooth: hci0: QCA ROM Version :0x00000200 Bluetooth: hci0: QCA Patch Version:0x00000d2b Bluetooth: hci0: QCA controller version 0x02000200 Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2 Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2) Bluetooth: hci0: QCA Failed to download patch (-2) ================================================================== BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c Write of size 4 at addr ffff279347d578c0 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT) Call trace: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa8/0x18c qcom_geni_serial_handle_rx+0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 If the RX FIFO depth changes after probe, be sure to resize the buffer.
Severity
8.8 (High)
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 16:05 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9 , < 894681682dbefdad917b88f86cde1069140a047a (git)
Affected: f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9 , < cb53a3366eb28fed67850c80afa52075bb71a38a (git)
Affected: f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9 , < fd524ca7fe45b8a06dca2dd546d62684a9768f95 (git)
Affected: f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9 , < b8caf69a6946e18ffebad49847e258f5b6d52ac2 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.7
Unaffected: 0 , < 5.7 (semver)
Unaffected: 5.10.165 , ≤ 5.10.* (semver)
Unaffected: 5.15.90 , ≤ 5.15.* (semver)
Unaffected: 6.1.8 , ≤ 6.1.* (semver)
Unaffected: 6.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48871",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T16:05:28.910017Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-12T17:32:54.202Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/qcom_geni_serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "894681682dbefdad917b88f86cde1069140a047a",
              "status": "affected",
              "version": "f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9",
              "versionType": "git"
            },
            {
              "lessThan": "cb53a3366eb28fed67850c80afa52075bb71a38a",
              "status": "affected",
              "version": "f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9",
              "versionType": "git"
            },
            {
              "lessThan": "fd524ca7fe45b8a06dca2dd546d62684a9768f95",
              "status": "affected",
              "version": "f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9",
              "versionType": "git"
            },
            {
              "lessThan": "b8caf69a6946e18ffebad49847e258f5b6d52ac2",
              "status": "affected",
              "version": "f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/tty/serial/qcom_geni_serial.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.165",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.90",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.165",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.90",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.8",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.2",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer\n\nDriver\u0027s probe allocates memory for RX FIFO (port-\u003erx_fifo) based on\ndefault RX FIFO depth, e.g. 16.  Later during serial startup the\nqcom_geni_serial_port_setup() updates the RX FIFO depth\n(port-\u003erx_fifo_depth) to match real device capabilities, e.g. to 32.\n\nThe RX UART handle code will read \"port-\u003erx_fifo_depth\" number of words\ninto \"port-\u003erx_fifo\" buffer, thus exceeding the bounds.  This can be\nobserved in certain configurations with Qualcomm Bluetooth HCI UART\ndevice and KASAN:\n\n  Bluetooth: hci0: QCA Product ID   :0x00000010\n  Bluetooth: hci0: QCA SOC Version  :0x400a0200\n  Bluetooth: hci0: QCA ROM Version  :0x00000200\n  Bluetooth: hci0: QCA Patch Version:0x00000d2b\n  Bluetooth: hci0: QCA controller version 0x02000200\n  Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv\n  bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2\n  Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)\n  Bluetooth: hci0: QCA Failed to download patch (-2)\n  ==================================================================\n  BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c\n  Write of size 4 at addr ffff279347d578c0 by task swapper/0/0\n\n  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26\n  Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\n  Call trace:\n   dump_backtrace.part.0+0xe0/0xf0\n   show_stack+0x18/0x40\n   dump_stack_lvl+0x8c/0xb8\n   print_report+0x188/0x488\n   kasan_report+0xb4/0x100\n   __asan_store4+0x80/0xa4\n   handle_rx_uart+0xa8/0x18c\n   qcom_geni_serial_handle_rx+0x84/0x9c\n   qcom_geni_serial_isr+0x24c/0x760\n   __handle_irq_event_percpu+0x108/0x500\n   handle_irq_event+0x6c/0x110\n   handle_fasteoi_irq+0x138/0x2cc\n   generic_handle_domain_irq+0x48/0x64\n\nIf the RX FIFO depth changes after probe, be sure to resize the buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - The buggy RX path is exercised on Qualcomm GENI UARTs used as Bluetooth HCI transports (as documented in the fix); an adjacent Bluetooth peer can drive HCI/ACL traffic that fills the UART RX FIFO and triggers the out-of-bounds write without physical serial access.\nAC:L - On affected Qualcomm hardware the FIFO-depth mismatch is a fixed device property after port setup, and sending enough RX data reliably overflows the undersized slab buffer with no race or attacker-uncontrollable condition required.\nPR:N - An adjacent Bluetooth attacker needs no local account or capabilities; the system Bluetooth stack opens the GENI UART, and unauthenticated adjacent RF activity can produce UART RX that hits the vulnerable ISR path.\nUI:N - No victim action is required beyond a normal deployment where Bluetooth/HCI UART is already enabled and the port has been set up by the platform Bluetooth service.\nS:U - The corruption is confined to host kernel heap memory in the same security authority; this is privilege escalation / DoS on the local kernel, not a VM/IOMMU/sandbox boundary crossing.\nC:H - The slab out-of-bounds write of attacker-influenced UART RX bytes into adjacent heap objects is memory corruption that can be leveraged to obtain arbitrary kernel read primitives.\nI:H - Out-of-bounds heap write of controlled RX FIFO contents into neighboring slab objects enables corruption of kernel structures and control-flow hijacking / arbitrary write primitives.\nA:H - The same out-of-bounds write can crash the kernel (as shown by the KASAN slab-out-of-bounds report in softirq/ISR context), yielding a full availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:52:41.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2"
        }
      ],
      "title": "tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48871",
    "datePublished": "2024-08-21T06:10:01.859Z",
    "dateReserved": "2024-07-16T11:38:08.921Z",
    "dateUpdated": "2026-08-05T08:52:41.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48871",
      "date": "2026-09-16",
      "epss": "0.00349",
      "percentile": "0.28308"
    },
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.7\", \"versionEndExcluding\": \"5.10.165\", \"matchCriteriaId\": \"5D1B38E6-531E-4689-A204-9E0178E886F5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.11\", \"versionEndExcluding\": \"5.15.90\", \"matchCriteriaId\": \"E995CDA5-7223-4FDB-BAD3-81B22C763A43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.8\", \"matchCriteriaId\": \"A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer\\n\\nDriver\u0027s probe allocates memory for RX FIFO (port-\u003erx_fifo) based on\\ndefault RX FIFO depth, e.g. 16.  Later during serial startup the\\nqcom_geni_serial_port_setup() updates the RX FIFO depth\\n(port-\u003erx_fifo_depth) to match real device capabilities, e.g. to 32.\\n\\nThe RX UART handle code will read \\\"port-\u003erx_fifo_depth\\\" number of words\\ninto \\\"port-\u003erx_fifo\\\" buffer, thus exceeding the bounds.  This can be\\nobserved in certain configurations with Qualcomm Bluetooth HCI UART\\ndevice and KASAN:\\n\\n  Bluetooth: hci0: QCA Product ID   :0x00000010\\n  Bluetooth: hci0: QCA SOC Version  :0x400a0200\\n  Bluetooth: hci0: QCA ROM Version  :0x00000200\\n  Bluetooth: hci0: QCA Patch Version:0x00000d2b\\n  Bluetooth: hci0: QCA controller version 0x02000200\\n  Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv\\n  bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2\\n  Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)\\n  Bluetooth: hci0: QCA Failed to download patch (-2)\\n  ==================================================================\\n  BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c\\n  Write of size 4 at addr ffff279347d578c0 by task swapper/0/0\\n\\n  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26\\n  Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\\n  Call trace:\\n   dump_backtrace.part.0+0xe0/0xf0\\n   show_stack+0x18/0x40\\n   dump_stack_lvl+0x8c/0xb8\\n   print_report+0x188/0x488\\n   kasan_report+0xb4/0x100\\n   __asan_store4+0x80/0xa4\\n   handle_rx_uart+0xa8/0x18c\\n   qcom_geni_serial_handle_rx+0x84/0x9c\\n   qcom_geni_serial_isr+0x24c/0x760\\n   __handle_irq_event_percpu+0x108/0x500\\n   handle_irq_event+0x6c/0x110\\n   handle_fasteoi_irq+0x138/0x2cc\\n   generic_handle_domain_irq+0x48/0x64\\n\\nIf the RX FIFO depth changes after probe, be sure to resize the buffer.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: serial: qcom-geni-serial: corrige los l\\u00edmites fuera de los l\\u00edmites en el b\\u00fafer RX FIFO La sonda del controlador asigna memoria para RX FIFO (puerto-\u0026gt;rx_fifo) seg\\u00fan el valor predeterminado Profundidad FIFO de RX, por ejemplo, 16. M\\u00e1s adelante, durante el inicio en serie, qcom_geni_serial_port_setup() actualiza la profundidad FIFO de RX (puerto-\u0026gt;rx_fifo_profundidad) para que coincida con las capacidades reales del dispositivo, por ejemplo, a 32. El c\\u00f3digo de identificador de RX UART leer\\u00e1 el n\\u00famero \\\"puerto-\u0026gt;rx_fifo_profundidad\\\" de palabras en el b\\u00fafer \\\"port-\u0026gt;rx_fifo\\\", excediendo as\\u00ed los l\\u00edmites. Esto se puede observar en ciertas configuraciones con el dispositivo Qualcomm Bluetooth HCI UART y KASAN: Bluetooth: hci0: QCA ID de producto: 0x00000010 Bluetooth: hci0: QCA SOC Version: 0x400a0200 Bluetooth: hci0: QCA ROM Version: 0x00000200 Bluetooth: hci0: QCA Patch Version :0x00000d2b Bluetooth: hci0: versi\\u00f3n del controlador QCA 0x02000200 Bluetooth: hci0: QCA Descargando qca/htbtfw20.tlv bluetooth hci0: La carga directa del firmware para qca/htbtfw20.tlv fall\\u00f3 con el error -2 Bluetooth: hci0: QCA No se pudo solicitar el archivo: qca/ htbtfw20.tlv (-2) Bluetooth: hci0: QCA Error al descargar el parche (-2) =============================== ==================================== ERROR: KASAN: losa fuera de los l\\u00edmites en handle_rx_uart+ 0xa8/0x18c Escritura de tama\\u00f1o 4 en la direcci\\u00f3n ffff279347d578c0 mediante task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Nombre de hardware: Qualcomm Technologies, Inc Rob\\u00f3tica RB5 (DT) Seguimiento de llamadas: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa. 8/0x18c qcom_geni_serial_handle_rx+ 0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 Si la profundidad FIFO de RX cambia despu\\u00e9s sonda, aseg\\u00farese de cambiar el tama\\u00f1o del b\\u00fafer.\"}]",
      "id": "CVE-2022-48871",
      "lastModified": "2024-09-06T14:23:03.010",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\", \"baseScore\": 7.1, \"baseSeverity\": \"HIGH\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 5.2}]}",
      "published": "2024-08-21T07:15:04.207",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-125\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-48871\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-08-21T07:15:04.207\",\"lastModified\":\"2026-08-04T10:17:24.623\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer\\n\\nDriver\u0027s probe allocates memory for RX FIFO (port-\u003erx_fifo) based on\\ndefault RX FIFO depth, e.g. 16.  Later during serial startup the\\nqcom_geni_serial_port_setup() updates the RX FIFO depth\\n(port-\u003erx_fifo_depth) to match real device capabilities, e.g. to 32.\\n\\nThe RX UART handle code will read \\\"port-\u003erx_fifo_depth\\\" number of words\\ninto \\\"port-\u003erx_fifo\\\" buffer, thus exceeding the bounds.  This can be\\nobserved in certain configurations with Qualcomm Bluetooth HCI UART\\ndevice and KASAN:\\n\\n  Bluetooth: hci0: QCA Product ID   :0x00000010\\n  Bluetooth: hci0: QCA SOC Version  :0x400a0200\\n  Bluetooth: hci0: QCA ROM Version  :0x00000200\\n  Bluetooth: hci0: QCA Patch Version:0x00000d2b\\n  Bluetooth: hci0: QCA controller version 0x02000200\\n  Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv\\n  bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2\\n  Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)\\n  Bluetooth: hci0: QCA Failed to download patch (-2)\\n  ==================================================================\\n  BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c\\n  Write of size 4 at addr ffff279347d578c0 by task swapper/0/0\\n\\n  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26\\n  Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\\n  Call trace:\\n   dump_backtrace.part.0+0xe0/0xf0\\n   show_stack+0x18/0x40\\n   dump_stack_lvl+0x8c/0xb8\\n   print_report+0x188/0x488\\n   kasan_report+0xb4/0x100\\n   __asan_store4+0x80/0xa4\\n   handle_rx_uart+0xa8/0x18c\\n   qcom_geni_serial_handle_rx+0x84/0x9c\\n   qcom_geni_serial_isr+0x24c/0x760\\n   __handle_irq_event_percpu+0x108/0x500\\n   handle_irq_event+0x6c/0x110\\n   handle_fasteoi_irq+0x138/0x2cc\\n   generic_handle_domain_irq+0x48/0x64\\n\\nIf the RX FIFO depth changes after probe, be sure to resize the buffer.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: tty: serial: qcom-geni-serial: corrige los l\u00edmites fuera de los l\u00edmites en el b\u00fafer RX FIFO La sonda del controlador asigna memoria para RX FIFO (puerto-\u0026gt;rx_fifo) seg\u00fan el valor predeterminado Profundidad FIFO de RX, por ejemplo, 16. M\u00e1s adelante, durante el inicio en serie, qcom_geni_serial_port_setup() actualiza la profundidad FIFO de RX (puerto-\u0026gt;rx_fifo_profundidad) para que coincida con las capacidades reales del dispositivo, por ejemplo, a 32. El c\u00f3digo de identificador de RX UART leer\u00e1 el n\u00famero \\\"puerto-\u0026gt;rx_fifo_profundidad\\\" de palabras en el b\u00fafer \\\"port-\u0026gt;rx_fifo\\\", excediendo as\u00ed los l\u00edmites. Esto se puede observar en ciertas configuraciones con el dispositivo Qualcomm Bluetooth HCI UART y KASAN: Bluetooth: hci0: QCA ID de producto: 0x00000010 Bluetooth: hci0: QCA SOC Version: 0x400a0200 Bluetooth: hci0: QCA ROM Version: 0x00000200 Bluetooth: hci0: QCA Patch Version :0x00000d2b Bluetooth: hci0: versi\u00f3n del controlador QCA 0x02000200 Bluetooth: hci0: QCA Descargando qca/htbtfw20.tlv bluetooth hci0: La carga directa del firmware para qca/htbtfw20.tlv fall\u00f3 con el error -2 Bluetooth: hci0: QCA No se pudo solicitar el archivo: qca/ htbtfw20.tlv (-2) Bluetooth: hci0: QCA Error al descargar el parche (-2) =============================== ==================================== ERROR: KASAN: losa fuera de los l\u00edmites en handle_rx_uart+ 0xa8/0x18c Escritura de tama\u00f1o 4 en la direcci\u00f3n ffff279347d578c0 mediante task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26 Nombre de hardware: Qualcomm Technologies, Inc Rob\u00f3tica RB5 (DT) Seguimiento de llamadas: dump_backtrace.part.0+0xe0/0xf0 show_stack+0x18/0x40 dump_stack_lvl+0x8c/0xb8 print_report+0x188/0x488 kasan_report+0xb4/0x100 __asan_store4+0x80/0xa4 handle_rx_uart+0xa. 8/0x18c qcom_geni_serial_handle_rx+ 0x84/0x9c qcom_geni_serial_isr+0x24c/0x760 __handle_irq_event_percpu+0x108/0x500 handle_irq_event+0x6c/0x110 handle_fasteoi_irq+0x138/0x2cc generic_handle_domain_irq+0x48/0x64 Si la profundidad FIFO de RX cambia despu\u00e9s sonda, aseg\u00farese de cambiar el tama\u00f1o del b\u00fafer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/tty/serial/qcom_geni_serial.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\",\"lessThan\":\"894681682dbefdad917b88f86cde1069140a047a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\",\"lessThan\":\"cb53a3366eb28fed67850c80afa52075bb71a38a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\",\"lessThan\":\"fd524ca7fe45b8a06dca2dd546d62684a9768f95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\",\"lessThan\":\"b8caf69a6946e18ffebad49847e258f5b6d52ac2\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/tty/serial/qcom_geni_serial.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.7\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.7\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.165\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.90\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.8\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"ADJACENT_NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-09-10T16:05:28.910017Z\",\"id\":\"CVE-2022-48871\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.7\",\"versionEndExcluding\":\"5.10.165\",\"matchCriteriaId\":\"5D1B38E6-531E-4689-A204-9E0178E886F5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.90\",\"matchCriteriaId\":\"E995CDA5-7223-4FDB-BAD3-81B22C763A43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.8\",\"matchCriteriaId\":\"A6AFE6C9-3F59-4711-B2CF-7D6682FF6BD0\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-04T13:46:12+00:00",
      "cve": "CVE-2022-48871",
      "id": "CVE-2022-48871",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48871.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-11T02:33:15Z",
      "cve": "CVE-2022-48871",
      "id": "CVE-2022-48871",
      "initial_release_date": "2024-08-22T03:29:38Z",
      "product_status:known_affected": "310",
      "product_status:known_not_affected": "250",
      "product_status:recommended": "411",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48871",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48871.json",
      "version": "50"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-48871\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-10T16:05:28.910017Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-11T12:42:11.934Z\"}}], \"cna\": {\"title\": \"tty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:A - The buggy RX path is exercised on Qualcomm GENI UARTs used as Bluetooth HCI transports (as documented in the fix); an adjacent Bluetooth peer can drive HCI/ACL traffic that fills the UART RX FIFO and triggers the out-of-bounds write without physical serial access.\\nAC:L - On affected Qualcomm hardware the FIFO-depth mismatch is a fixed device property after port setup, and sending enough RX data reliably overflows the undersized slab buffer with no race or attacker-uncontrollable condition required.\\nPR:N - An adjacent Bluetooth attacker needs no local account or capabilities; the system Bluetooth stack opens the GENI UART, and unauthenticated adjacent RF activity can produce UART RX that hits the vulnerable ISR path.\\nUI:N - No victim action is required beyond a normal deployment where Bluetooth/HCI UART is already enabled and the port has been set up by the platform Bluetooth service.\\nS:U - The corruption is confined to host kernel heap memory in the same security authority; this is privilege escalation / DoS on the local kernel, not a VM/IOMMU/sandbox boundary crossing.\\nC:H - The slab out-of-bounds write of attacker-influenced UART RX bytes into adjacent heap objects is memory corruption that can be leveraged to obtain arbitrary kernel read primitives.\\nI:H - Out-of-bounds heap write of controlled RX FIFO contents into neighboring slab objects enables corruption of kernel structures and control-flow hijacking / arbitrary write primitives.\\nA:H - The same out-of-bounds write can crash the kernel (as shown by the KASAN slab-out-of-bounds report in softirq/ISR context), yielding a full availability impact.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\", \"lessThan\": \"894681682dbefdad917b88f86cde1069140a047a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\", \"lessThan\": \"cb53a3366eb28fed67850c80afa52075bb71a38a\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\", \"lessThan\": \"fd524ca7fe45b8a06dca2dd546d62684a9768f95\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"f9d690b6ece7ec9a6ff6b588df95a010ab2d66f9\", \"lessThan\": \"b8caf69a6946e18ffebad49847e258f5b6d52ac2\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/tty/serial/qcom_geni_serial.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.7\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.7\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.165\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.90\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.8\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.2\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/tty/serial/qcom_geni_serial.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/894681682dbefdad917b88f86cde1069140a047a\"}, {\"url\": \"https://git.kernel.org/stable/c/cb53a3366eb28fed67850c80afa52075bb71a38a\"}, {\"url\": \"https://git.kernel.org/stable/c/fd524ca7fe45b8a06dca2dd546d62684a9768f95\"}, {\"url\": \"https://git.kernel.org/stable/c/b8caf69a6946e18ffebad49847e258f5b6d52ac2\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntty: serial: qcom-geni-serial: fix slab-out-of-bounds on RX FIFO buffer\\n\\nDriver\u0027s probe allocates memory for RX FIFO (port-\u003erx_fifo) based on\\ndefault RX FIFO depth, e.g. 16.  Later during serial startup the\\nqcom_geni_serial_port_setup() updates the RX FIFO depth\\n(port-\u003erx_fifo_depth) to match real device capabilities, e.g. to 32.\\n\\nThe RX UART handle code will read \\\"port-\u003erx_fifo_depth\\\" number of words\\ninto \\\"port-\u003erx_fifo\\\" buffer, thus exceeding the bounds.  This can be\\nobserved in certain configurations with Qualcomm Bluetooth HCI UART\\ndevice and KASAN:\\n\\n  Bluetooth: hci0: QCA Product ID   :0x00000010\\n  Bluetooth: hci0: QCA SOC Version  :0x400a0200\\n  Bluetooth: hci0: QCA ROM Version  :0x00000200\\n  Bluetooth: hci0: QCA Patch Version:0x00000d2b\\n  Bluetooth: hci0: QCA controller version 0x02000200\\n  Bluetooth: hci0: QCA Downloading qca/htbtfw20.tlv\\n  bluetooth hci0: Direct firmware load for qca/htbtfw20.tlv failed with error -2\\n  Bluetooth: hci0: QCA Failed to request file: qca/htbtfw20.tlv (-2)\\n  Bluetooth: hci0: QCA Failed to download patch (-2)\\n  ==================================================================\\n  BUG: KASAN: slab-out-of-bounds in handle_rx_uart+0xa8/0x18c\\n  Write of size 4 at addr ffff279347d578c0 by task swapper/0/0\\n\\n  CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-rt5-00350-gb2450b7e00be-dirty #26\\n  Hardware name: Qualcomm Technologies, Inc. Robotics RB5 (DT)\\n  Call trace:\\n   dump_backtrace.part.0+0xe0/0xf0\\n   show_stack+0x18/0x40\\n   dump_stack_lvl+0x8c/0xb8\\n   print_report+0x188/0x488\\n   kasan_report+0xb4/0x100\\n   __asan_store4+0x80/0xa4\\n   handle_rx_uart+0xa8/0x18c\\n   qcom_geni_serial_handle_rx+0x84/0x9c\\n   qcom_geni_serial_isr+0x24c/0x760\\n   __handle_irq_event_percpu+0x108/0x500\\n   handle_irq_event+0x6c/0x110\\n   handle_fasteoi_irq+0x138/0x2cc\\n   generic_handle_domain_irq+0x48/0x64\\n\\nIf the RX FIFO depth changes after probe, be sure to resize the buffer.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.165\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.90\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.8\", \"versionStartIncluding\": \"5.7\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.2\", \"versionStartIncluding\": \"5.7\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:52:41.934Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-48871\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:52:41.934Z\", \"dateReserved\": \"2024-07-16T11:38:08.921Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-08-21T06:10:01.859Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.