Bug 2258012 (CVE-2022-48619)

Summary: CVE-2022-48619 kernel: event code falling outside of a bitmap in input_set_capability() leads to panic
Product: [Other] Security Response Reporter: TEJ RATHI <trathi>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mmilgram, mstowell, nmurray, ptalbert, rogbas, rparrazo, rrobaina, rvrbovsk, rysulliv, scweaver, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 5.18-rc1 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in drivers/input/input.c in the Linux Kernel, where the input_set_capability() function mishandles scenarios where an event code is outside the bitmap. This issue can lead to a kernel panic when the event code exceeds the bitmap for the specified event type, which could allow an attacker to cause a kernel crash and potential disruption of services.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2263748    
Bug Blocks: 2258025    

Description TEJ RATHI 2024-01-12 06:14:36 UTC 
An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capability mishandles the situation in which an event code falls outside of a bitmap.

https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.10
https://github.com/torvalds/linux/commit/409353cbe9fe48f6bc196114c442b1cff05a39bc
Comment 2 Alex 2024-02-11 16:03:38 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2263748]
Comment 4 Justin M. Forbes 2024-02-15 19:26:58 UTC 
This was fixed for Fedora with the 5.17.10 stable kernel updates.
Comment 125 errata-xmlrpc 2024-09-24 00:36:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7001 https://access.redhat.com/errata/RHSA-2024:7001
Comment 126 errata-xmlrpc 2024-09-24 02:28:57 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7000 https://access.redhat.com/errata/RHSA-2024:7000