CVE-2022-48805: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
Vulnerability summary
CVE-2022-48805 is a high (CVSS 7.8) Out-of-bounds Read vulnerability in linux. EPSS estimates a 0.32% chance of exploitation in the next 30 days, higher than 24.8% of scored vulnerabilities.
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 11 · Related 11Timeline
- 16-07-2024PublishedVulnerability first disclosed.
- 11-05-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup ax88179_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (hdr_off..hdr_off+2*pkt_cnt) can be out of bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. I have tested that this can be used by a malicious USB device to send a bogus ICMPv6 Echo Request and receive an ICMPv6 Echo Reply in response that contains random kernel heap data. It's probably also possible to get OOB writes from this on a little-endian system somehow - maybe by triggering skb_cow() via IP options processing -, but I haven't tested that.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.32%
Chance of exploitation in the next 30 days
Percentile
25%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.32% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu93 products
- linuxAll versions (No fix recorded) | < 4.4.0-234.268 | < 4.15.0-177.186 | < 5.4.0-110.124
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1113.119 | < 4.4.0-1151.166 | < 4.15.0-1128.137 | < 5.4.0-1073.78
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < 711b6bf3fb052f0a6b5b3205d50e30c0c2980382 | ≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < 63f0cfb36c1f1964a59ce544156677601e2d8740 | ≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < 1668781ed24da43498799aa4f65714a7de201930 | ≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < a0fd5492ee769029a636f1fb521716b022b1423d | ≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < 758290defe93a865a2880d10c5d5abd288b64b5d | ≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < ffd0393adcdcefab7e131488e10dcfde5e02d6eb | ≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < 9681823f96a811268265f35307072ad80713c274 | ≥ e2ca90c276e1fc410d7cd3c1a4eee245ec902a20, < 57bc3d3ae8c14df3ceb4e17d26ddf9eeab304581 | 3.9
- linux_kernel≥ 3.9, < 4.9.303 | ≥ 4.10, < 4.14.268 | ≥ 4.15, < 4.19.231 | ≥ 4.20, < 5.4.180 | ≥ 5.5, < 5.10.101 | ≥ 5.11, < 5.15.24 | ≥ 5.16, < 5.16.10 | 5.17:rc1 | 5.17:rc2 | 5.17:rc3
Debian1 product
- linux< 5.16.10-1
3 vendors · 96 products
