CVE-2022-48927

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2022-48927", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-08-21T06:06:23.298Z", "datePublished": "2024-08-22T03:31:19.861Z", "dateUpdated": "2026-08-05T08:52:58.053Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:58.053Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: tsc2046: fix memory corruption by preventing array overflow\n\nOn one side we have indio_dev->num_channels includes all physical channels +\ntimestamp channel. On other side we have an array allocated only for\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\nnum_channels variable.\n\nNote the first case is a cleanup rather than a fix as the software\ntimestamp channel bit in active_scanmask is never set by the IIO core."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflow is in the TI TSC2046 SPI ADC/touchscreen IIO driver and is reached on local driver probe / subsequent local IIO buffer use, not via network or adjacent-network protocols.\nAC:L - The out-of-bounds access occurs deterministically whenever the driver probes with the vulnerable loop bound; no special race or attacker-uncontrollable state is required to hit the memory corruption.\nPR:L - Exploitation is in the context of a local unprivileged user on devices that expose this touchscreen/ADC (embedded/industrial/Android-class systems), without needing full root/init-namespace admin solely to benefit from the kernel corruption.\nUI:N - No separate victim action is required; the bad indexing runs during driver setup, and buffer enablement is performed by the attacker\u2019s own local process.\nS:U - Impact stays within the host kernel\u2019s authority (local memory corruption / privilege impact); it does not cross a VM, IOMMU, or other explicit security boundary.\nC:H - The bug is an out-of-bounds write/read against kernel memory (layout array overflow and read past ch_cfg into adjacent slab), which can be leveraged for information disclosure primitives under the kernel memory-corruption model.\nI:H - Out-of-bounds writes into adjacent private-state/heap (and potential undersized SPI TX/RX buffers used later) are integrity-impacting memory corruption that can support control-flow hijacking.\nA:H - Kernel out-of-bounds memory corruption in this path can oops/panic or otherwise hard-fail the kernel, so availability impact is high."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/adc/ti-tsc2046.c"], "versions": [{"version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "lessThan": "0cb9b2f73c182d242a640e512f4785c7c504512f", "status": "affected", "versionType": "git"}, {"version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "lessThan": "082d2c047b0d305bb0b6e9f9d671a09470e2db2d", "status": "affected", "versionType": "git"}, {"version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "lessThan": "b7a78a8adaa8849c02f174d707aead0f85dca0da", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/iio/adc/ti-tsc2046.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.26", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.16.12", "lessThanOrEqual": "5.16.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.17", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.26"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.16.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.17"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f"}, {"url": "https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d"}, {"url": "https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da"}], "title": "iio: adc: tsc2046: fix memory corruption by preventing array overflow", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:33:02.652045Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T17:33:00.502Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-48927", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-10T15:33:02.652045Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T12:42:12.682Z"}}], "cna": {"title": "iio: adc: tsc2046: fix memory corruption by preventing array overflow", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The overflow is in the TI TSC2046 SPI ADC/touchscreen IIO driver and is reached on local driver probe / subsequent local IIO buffer use, not via network or adjacent-network protocols.\nAC:L - The out-of-bounds access occurs deterministically whenever the driver probes with the vulnerable loop bound; no special race or attacker-uncontrollable state is required to hit the memory corruption.\nPR:L - Exploitation is in the context of a local unprivileged user on devices that expose this touchscreen/ADC (embedded/industrial/Android-class systems), without needing full root/init-namespace admin solely to benefit from the kernel corruption.\nUI:N - No separate victim action is required; the bad indexing runs during driver setup, and buffer enablement is performed by the attacker\u2019s own local process.\nS:U - Impact stays within the host kernel\u2019s authority (local memory corruption / privilege impact); it does not cross a VM, IOMMU, or other explicit security boundary.\nC:H - The bug is an out-of-bounds write/read against kernel memory (layout array overflow and read past ch_cfg into adjacent slab), which can be leveraged for information disclosure primitives under the kernel memory-corruption model.\nI:H - Out-of-bounds writes into adjacent private-state/heap (and potential undersized SPI TX/RX buffers used later) are integrity-impacting memory corruption that can support control-flow hijacking.\nA:H - Kernel out-of-bounds memory corruption in this path can oops/panic or otherwise hard-fail the kernel, so availability impact is high."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "lessThan": "0cb9b2f73c182d242a640e512f4785c7c504512f", "versionType": "git"}, {"status": "affected", "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "lessThan": "082d2c047b0d305bb0b6e9f9d671a09470e2db2d", "versionType": "git"}, {"status": "affected", "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "lessThan": "b7a78a8adaa8849c02f174d707aead0f85dca0da", "versionType": "git"}], "programFiles": ["drivers/iio/adc/ti-tsc2046.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.26", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "5.16.12", "versionType": "semver", "lessThanOrEqual": "5.16.*"}, {"status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/iio/adc/ti-tsc2046.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f"}, {"url": "https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d"}, {"url": "https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: tsc2046: fix memory corruption by preventing array overflow\n\nOn one side we have indio_dev->num_channels includes all physical channels +\ntimestamp channel. On other side we have an array allocated only for\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\nnum_channels variable.\n\nNote the first case is a cleanup rather than a fix as the software\ntimestamp channel bit in active_scanmask is never set by the IIO core."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.26", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.16.12", "versionStartIncluding": "5.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.17", "versionStartIncluding": "5.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T08:52:58.053Z"}}}, "cveMetadata": {"cveId": "CVE-2022-48927", "state": "PUBLISHED", "dateUpdated": "2026-08-05T08:52:58.053Z", "dateReserved": "2024-08-21T06:06:23.298Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-08-22T03:31:19.861Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/iio/adc/ti-tsc2046.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "0cb9b2f73c182d242a640e512f4785c7c504512f", "status": "affected", "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "versionType": "git"}, {"lessThan": "082d2c047b0d305bb0b6e9f9d671a09470e2db2d", "status": "affected", "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "versionType": "git"}, {"lessThan": "b7a78a8adaa8849c02f174d707aead0f85dca0da", "status": "affected", "version": "9374e8f5a38defe90bc65b2decf317c1c62d91dd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/iio/adc/ti-tsc2046.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.26", "versionType": "semver"}, {"lessThanOrEqual": "5.16.*", "status": "unaffected", "version": "5.16.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "5.17", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4549DFF-A0BC-4C08-B874-F0090921E478", "versionEndExcluding": "5.15.26", "versionStartIncluding": "5.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C76BAB21-7F23-4AD8-A25F-CA7B262A2698", "versionEndExcluding": "5.16.12", "versionStartIncluding": "5.16", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\niio: adc: tsc2046: fix memory corruption by preventing array overflow\n\nOn one side we have indio_dev->num_channels includes all physical channels +\ntimestamp channel. On other side we have an array allocated only for\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\nnum_channels variable.\n\nNote the first case is a cleanup rather than a fix as the software\ntimestamp channel bit in active_scanmask is never set by the IIO core."}, {"lang": "es", "value": "En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iio: adc: tsc2046: corrige la corrupci\u00f3n de la memoria evitando el desbordamiento de la matriz. Por un lado tenemos indio_dev->num_channels incluye todos los canales f\u00edsicos + canal de marca de tiempo. Del otro lado tenemos un array asignado s\u00f3lo para canales f\u00edsicos. Por lo tanto, corrija la corrupci\u00f3n de la memoria con ARRAY_SIZE() en lugar de la variable num_channels. Tenga en cuenta que el primer caso es una limpieza en lugar de una soluci\u00f3n, ya que el n\u00facleo IIO nunca establece el bit del canal de marca de tiempo del software en active_scanmask."}], "id": "CVE-2022-48927", "lastModified": "2026-08-04T10:17:26.927", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2022-48927", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-10T15:33:02.652045Z", "version": "2.0.3"}}]}, "published": "2024-08-22T04:15:15.530", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/082d2c047b0d305bb0b6e9f9d671a09470e2db2d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0cb9b2f73c182d242a640e512f4785c7c504512f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b7a78a8adaa8849c02f174d707aead0f85dca0da"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: iio: adc: tsc2046: fix memory corruption by preventing array overflow", "id": "2307183", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2307183"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-120", "details": ["In the Linux kernel, the following vulnerability has been resolved:\niio: adc: tsc2046: fix memory corruption by preventing array overflow\nOn one side we have indio_dev->num_channels includes all physical channels +\ntimestamp channel. On other side we have an array allocated only for\nphysical channels. So, fix memory corruption by ARRAY_SIZE() instead of\nnum_channels variable.\nNote the first case is a cleanup rather than a fix as the software\ntimestamp channel bit in active_scanmask is never set by the IIO core."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-48927", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-48927\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-48927\nhttps://lore.kernel.org/linux-cve-announce/2024082221-CVE-2022-48927-392a@gregkh/T"], "statement": "Red Hat Enterprise Linux is not impacted by this CVE, as the vulnerability in question does not affect the specific versions or configurations of the Linux kernel used in its distributions. This ensures that users of Red Hat Enterprise Linux are not exposed to the potential risks associated with this issue, and no further action or mitigation is necessary for systems running this operating system.", "threat_severity": "Important"}

{}