CVSS 3.1
7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2022-48948
High (7.8) in linux linux kernel. EPSS 0.3% chance of exploitation in the next 30 days.
In the Linux kernel, the following vulnerability has been resolved:
usb: gadget: uvc: Prevent buffer overflow in setup handler
Setup function uvc_function_setup permits control transfer
requests with up to 64 bytes of payload (UVC_MAX_REQUEST_SIZE),
data stage handler for OUT transfer uses memcpy to copy req->actual
bytes to uvc_event->data.data array of size 60. This may result
in an overflow of 4 bytes.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 19% of CVEs (scores of 2026-10-31)
- CWE
- CWE-120
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linux:linux_kernel
References
- https://git.kernel.org/stable/c/06fd17ee92c8f1704c7e54ec0fd50ae0542a49a5
- https://git.kernel.org/stable/c/4972e3528b968665b596b5434764ff8fd9446d35
- https://git.kernel.org/stable/c/4c92670b16727365699fe4b19ed32013bab2c107
- https://git.kernel.org/stable/c/6b41a35b41f77821db24f2d8f66794b390a585c5
- https://git.kernel.org/stable/c/7b1f773277a72f9756d47a41b94e43506cce1954