GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2022-48632 (GCVE-0-2022-48632)

Vulnerability from cvelistv5 – Published: 2024-04-28 12:59 – Updated: 2026-08-05 08:51
VLAI
Title
i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()
Summary
In the Linux kernel, the following vulnerability has been resolved: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() memcpy() is called in a loop while 'operation->length' upper bound is not checked and 'data_idx' also increments.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 15:46 UTC
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b5b5b32081cd206baa6e58cca7f112d9723785d6 , < 48ee0a864d1af02eea98fc825cc230d61517a71e (git)
Affected: b5b5b32081cd206baa6e58cca7f112d9723785d6 , < dc2a0c587006f29b724069740c48654b9dcaebd2 (git)
Affected: b5b5b32081cd206baa6e58cca7f112d9723785d6 , < 3b5ab5fbe69ebbee5692c72b05071a43fc0655d8 (git)
Affected: b5b5b32081cd206baa6e58cca7f112d9723785d6 , < de24aceb07d426b6f1c59f33889d6a964770547b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.10
Unaffected: 0 , < 5.10 (semver)
Unaffected: 5.10.146 , ≤ 5.10.* (semver)
Unaffected: 5.15.71 , ≤ 5.15.* (semver)
Unaffected: 5.19.12 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T15:17:55.519Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-48632",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:46:27.328258Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-11T17:33:12.457Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-mlxbf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "48ee0a864d1af02eea98fc825cc230d61517a71e",
              "status": "affected",
              "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
              "versionType": "git"
            },
            {
              "lessThan": "dc2a0c587006f29b724069740c48654b9dcaebd2",
              "status": "affected",
              "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
              "versionType": "git"
            },
            {
              "lessThan": "3b5ab5fbe69ebbee5692c72b05071a43fc0655d8",
              "status": "affected",
              "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
              "versionType": "git"
            },
            {
              "lessThan": "de24aceb07d426b6f1c59f33889d6a964770547b",
              "status": "affected",
              "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/i2c/busses/i2c-mlxbf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.146",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.71",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.146",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.71",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.12",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "5.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()\n\nmemcpy() is called in a loop while \u0027operation-\u003elength\u0027 upper bound\nis not checked and \u0027data_idx\u0027 also increments."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The overflow is in the BlueField I2C master SMBus path (mlxbf_i2c_smbus_xfer \u2192 mlxbf_i2c_smbus_start_transaction), reached via local /dev/i2c-* I2C_SMBUS ioctls or in-kernel I2C clients on the DPU\u2014not via network packets or physical bus injection.\nAC:L - An attacker who can issue SMBus transactions supplies the operation lengths and write buffers directly; no race, probabilistic memory layout, or other attacker-uncontrollable condition is required to exercise the unbounded memcpy into the stack buffer.\nPR:L - i2cdev_open() performs no capability check\u2014access is only DAC on /dev/i2c-*. On BlueField management deployments, i2c group or otherwise relaxed device permissions are a realistic worst case, so a non-root local user can reach the path (higher severity than assuming root-only 0600).\nUI:N - The attacker triggers the vulnerable ioctl/transaction path themselves; no victim mount, file open, or other interactive action is required.\nS:U - Impact is ordinary in-kernel stack memory corruption on the BlueField host OS authority. The slave/IPMB path is separate and this is not a VM escape, IOMMU bypass, or host/DPU boundary cross.\nC:H - The bug is a stack buffer overflow via memcpy of attacker-controlled SMBus write data into a fixed 128-byte data_desc; such stack corruption is scored as enabling high confidentiality impact (info disclosure / read primitives) under the higher-severity rule.\nI:H - Attacker-controlled out-of-bounds stack writes can overwrite saved return addresses and adjacent stack state, yielding a control-flow/arbitrary-write primitive and Integrity High for this class of memory corruption.\nA:H - Corrupting the kernel stack in mlxbf_i2c_smbus_start_transaction reliably causes oops/panic or otherwise denies service, which is Availability High under kernel CVSS guidance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:51:34.167Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
        },
        {
          "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
        }
      ],
      "title": "i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-48632",
    "datePublished": "2024-04-28T12:59:10.481Z",
    "dateReserved": "2024-02-25T13:44:28.315Z",
    "dateUpdated": "2026-08-05T08:51:34.167Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-48632",
      "date": "2026-09-19",
      "epss": "0.00253",
      "percentile": "0.17131"
    },
    "fkie_nvd": {
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()\n\nmemcpy() is called in a loop while \u0027operation-\u003elength\u0027 upper bound\nis not checked and \u0027data_idx\u0027 also increments."
        },
        {
          "lang": "es",
          "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i2c: mlxbf: evita el desbordamiento de pila en mlxbf_i2c_smbus_start_transaction() memcpy() se llama en un bucle mientras que el l\u00edmite superior \u0027operation-\u0026gt;length\u0027 no est\u00e1 marcado y \u0027data_idx\u0027 tambi\u00e9n aumenta."
        }
      ],
      "id": "CVE-2022-48632",
      "lastModified": "2024-11-21T07:33:39.170",
      "published": "2024-04-28T13:15:06.517",
      "references": [
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
        },
        {
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
        }
      ],
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Awaiting Analysis"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/i2c/busses/i2c-mlxbf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "48ee0a864d1af02eea98fc825cc230d61517a71e",
                    "status": "affected",
                    "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dc2a0c587006f29b724069740c48654b9dcaebd2",
                    "status": "affected",
                    "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3b5ab5fbe69ebbee5692c72b05071a43fc0655d8",
                    "status": "affected",
                    "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "de24aceb07d426b6f1c59f33889d6a964770547b",
                    "status": "affected",
                    "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/i2c/busses/i2c-mlxbf.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.10"
                  },
                  {
                    "lessThan": "5.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.146",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.71",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.19.*",
                    "status": "unaffected",
                    "version": "5.19.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "6.0",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "26BCCE2C-EE0C-437D-A9D6-6714B5AE47CC",
                    "versionEndExcluding": "5.10.146",
                    "versionStartIncluding": "5.10",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "080C1827-D257-4D5A-9071-779EF7F5EF0B",
                    "versionEndExcluding": "5.15.71",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "03B0F56B-C5CC-4E81-BB51-D07D569DE4CA",
                    "versionEndExcluding": "5.19.12",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E8BD11A3-8643-49B6-BADE-5029A0117325",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "5F0AD220-F6A9-4012-8636-155F1B841FAD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "A46498B3-78E1-4623-AAE1-94D29A42BE4E",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "F8446E87-F5F6-41CA-8201-BAE0F0CA6DD9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc5:*:*:*:*:*:*",
                    "matchCriteriaId": "8E5FB72F-67CE-43CC-83FE-541604D98182",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:6.0:rc6:*:*:*:*:*:*",
                    "matchCriteriaId": "3A0A7397-F5F8-4753-82DC-9A11288E696D",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()\n\nmemcpy() is called in a loop while \u0027operation-\u003elength\u0027 upper bound\nis not checked and \u0027data_idx\u0027 also increments."
          },
          {
            "lang": "es",
            "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: i2c: mlxbf: evita el desbordamiento de pila en mlxbf_i2c_smbus_start_transaction() memcpy() se llama en un bucle mientras que el l\u00edmite superior \u0027operation-\u0026gt;length\u0027 no est\u00e1 marcado y \u0027data_idx\u0027 tambi\u00e9n aumenta."
          }
        ],
        "id": "CVE-2022-48632",
        "lastModified": "2026-08-04T10:17:13.640",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2022-48632",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-10T15:46:27.328258Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-04-28T13:15:06.517",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Mailing List",
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-04T19:51:49+00:00",
      "cve": "CVE-2022-48632",
      "id": "CVE-2022-48632",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:fixed": "429",
      "product_status:known_affected": "22",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-48632.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-08T00:17:45Z",
      "cve": "CVE-2022-48632",
      "id": "CVE-2022-48632",
      "initial_release_date": "2024-04-30T02:26:34Z",
      "product_status:known_affected": "270",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "506",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-48632",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-48632.json",
      "version": "58"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-03T15:17:55.519Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2022-48632",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-09-10T15:46:27.328258Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-09-11T12:42:15.343Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "Linux",
              "programFiles": [
                "drivers/i2c/busses/i2c-mlxbf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "lessThan": "48ee0a864d1af02eea98fc825cc230d61517a71e",
                  "status": "affected",
                  "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                  "versionType": "git"
                },
                {
                  "lessThan": "dc2a0c587006f29b724069740c48654b9dcaebd2",
                  "status": "affected",
                  "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                  "versionType": "git"
                },
                {
                  "lessThan": "3b5ab5fbe69ebbee5692c72b05071a43fc0655d8",
                  "status": "affected",
                  "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                  "versionType": "git"
                },
                {
                  "lessThan": "de24aceb07d426b6f1c59f33889d6a964770547b",
                  "status": "affected",
                  "version": "b5b5b32081cd206baa6e58cca7f112d9723785d6",
                  "versionType": "git"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "Linux",
              "programFiles": [
                "drivers/i2c/busses/i2c-mlxbf.c"
              ],
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "vendor": "Linux",
              "versions": [
                {
                  "status": "affected",
                  "version": "5.10"
                },
                {
                  "lessThan": "5.10",
                  "status": "unaffected",
                  "version": "0",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.10.*",
                  "status": "unaffected",
                  "version": "5.10.146",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.15.*",
                  "status": "unaffected",
                  "version": "5.15.71",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "5.19.*",
                  "status": "unaffected",
                  "version": "5.19.12",
                  "versionType": "semver"
                },
                {
                  "lessThanOrEqual": "*",
                  "status": "unaffected",
                  "version": "6.0",
                  "versionType": "original_commit_for_fix"
                }
              ]
            }
          ],
          "cpeApplicability": [
            {
              "nodes": [
                {
                  "cpeMatch": [
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.10.146",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.15.71",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "5.19.12",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    },
                    {
                      "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                      "versionEndExcluding": "6.0",
                      "versionStartIncluding": "5.10",
                      "vulnerable": true
                    }
                  ],
                  "negate": false,
                  "operator": "OR"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ni2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()\n\nmemcpy() is called in a loop while \u0027operation-\u003elength\u0027 upper bound\nis not checked and \u0027data_idx\u0027 also increments."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "scenarios": [
                {
                  "lang": "en",
                  "value": "AV:L - The overflow is in the BlueField I2C master SMBus path (mlxbf_i2c_smbus_xfer \u2192 mlxbf_i2c_smbus_start_transaction), reached via local /dev/i2c-* I2C_SMBUS ioctls or in-kernel I2C clients on the DPU\u2014not via network packets or physical bus injection.\nAC:L - An attacker who can issue SMBus transactions supplies the operation lengths and write buffers directly; no race, probabilistic memory layout, or other attacker-uncontrollable condition is required to exercise the unbounded memcpy into the stack buffer.\nPR:L - i2cdev_open() performs no capability check\u2014access is only DAC on /dev/i2c-*. On BlueField management deployments, i2c group or otherwise relaxed device permissions are a realistic worst case, so a non-root local user can reach the path (higher severity than assuming root-only 0600).\nUI:N - The attacker triggers the vulnerable ioctl/transaction path themselves; no victim mount, file open, or other interactive action is required.\nS:U - Impact is ordinary in-kernel stack memory corruption on the BlueField host OS authority. The slave/IPMB path is separate and this is not a VM escape, IOMMU bypass, or host/DPU boundary cross.\nC:H - The bug is a stack buffer overflow via memcpy of attacker-controlled SMBus write data into a fixed 128-byte data_desc; such stack corruption is scored as enabling high confidentiality impact (info disclosure / read primitives) under the higher-severity rule.\nI:H - Attacker-controlled out-of-bounds stack writes can overwrite saved return addresses and adjacent stack state, yielding a control-flow/arbitrary-write primitive and Integrity High for this class of memory corruption.\nA:H - Corrupting the kernel stack in mlxbf_i2c_smbus_start_transaction reliably causes oops/panic or otherwise denies service, which is Availability High under kernel CVSS guidance."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-05T08:51:34.167Z",
            "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "shortName": "Linux"
          },
          "references": [
            {
              "url": "https://git.kernel.org/stable/c/48ee0a864d1af02eea98fc825cc230d61517a71e"
            },
            {
              "url": "https://git.kernel.org/stable/c/dc2a0c587006f29b724069740c48654b9dcaebd2"
            },
            {
              "url": "https://git.kernel.org/stable/c/3b5ab5fbe69ebbee5692c72b05071a43fc0655d8"
            },
            {
              "url": "https://git.kernel.org/stable/c/de24aceb07d426b6f1c59f33889d6a964770547b"
            }
          ],
          "title": "i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction()",
          "x_generator": {
            "engine": "bippy-1.2.0"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "assignerShortName": "Linux",
        "cveId": "CVE-2022-48632",
        "datePublished": "2024-04-28T12:59:10.481Z",
        "dateReserved": "2024-02-25T13:44:28.315Z",
        "dateUpdated": "2026-08-05T08:51:34.167Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.