CVE-2022-48978
Description
A flaw was found in the Linux kernel's Human Interface Device (HID) core. A local attacker with low privileges could exploit a shift-out-of-bounds vulnerability in the hid_report_raw_event function. This occurs when the size of an integer in the snto32() function exceeds 32 bits, leading to an invalid shift operation. Successful exploitation of this vulnerability could result in a system crash, causing a denial of service.
Mitigation
To prevent exploitation, blacklist the `hid` kernel module. Create `/etc/modprobe.d/disable-hid.conf` with `install hid /bin/true`. Regenerate the initramfs and reboot the system. Note that disabling the `hid` module will prevent the use of Human Interface Devices, such as keyboards and mice, impacting system usability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | High | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
