Linux Kernel up to 5.18.3 USB platform_get_resource return value

Summaryinfo

A vulnerability labeled as problematic has been found in Linux Kernel up to 5.18.3. The affected element is the function platform_get_resource of the component USB. Such manipulation leads to return value. This vulnerability is uniquely identified as CVE-2022-49302. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.18.3 and classified as problematic. Affected by this issue is the function platform_get_resource of the component USB. The manipulation with an unknown input leads to a return value vulnerability. Using CWE to declare the problem leads to CWE-252. The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions. The impact remains unknown. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: USB: host: isp116x: check return value after calling platform_get_resource() It will cause null-ptr-deref if platform_get_resource() returns NULL, we need check the return value.

The advisory is shared for download at git.kernel.org. This vulnerability is handled as CVE-2022-49302 since 02/26/2025. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 02/26/2025).

Upgrading to version 4.9.318, 4.14.283, 4.19.247, 5.4.198, 5.10.122, 5.15.47, 5.17.15 or 5.18.4 eliminates this vulnerability. Applying the patch 804de302ada3544699c5f48c5314b249af76faa3/7bffda1560a6f255fdf504e059fbbdb5d46b9e44/3825db88d8c704e7992b685618a03f82bffcf2ef/c91a74b1f0f2d2d7e728742ae55e3ffe9ba7853d/ee105039d3653444de4d3ede642383c92855dc1e/3592cfd8b848bf0c4d7740d78a87a7b8f6e1fa9a/aca0cab0e9ed33b6371aafb519a6c38f2850ffc3/82a101f14943f479fd190b1e5b40d91c77e2ac1b/134a3408c2d3f7e23eb0e4556e0a2d9f36c2614e is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.9.317
• 4.14.282
• 4.19.246
• 5.4.197
• 5.10.121
• 5.15.0
• 5.15.1
• 5.15.2
• 5.15.3
• 5.15.4
• 5.15.5
• 5.15.6
• 5.15.7
• 5.15.8
• 5.15.9
• 5.15.10
• 5.15.11
• 5.15.12
• 5.15.13
• 5.15.14
• 5.15.15
• 5.15.16
• 5.15.17
• 5.15.18
• 5.15.19
• 5.15.20
• 5.15.21
• 5.15.22
• 5.15.23
• 5.15.24
• 5.15.25
• 5.15.26
• 5.15.27
• 5.15.28
• 5.15.29
• 5.15.30
• 5.15.31
• 5.15.32
• 5.15.33
• 5.15.34
• 5.15.35
• 5.15.36
• 5.15.37
• 5.15.38
• 5.15.39
• 5.15.40
• 5.15.41
• 5.15.42
• 5.15.43
• 5.15.44
• 5.15.45
• 5.15.46
• 5.17.0
• 5.17.1
• 5.17.2
• 5.17.3
• 5.17.4
• 5.17.5
• 5.17.6
• 5.17.7
• 5.17.8
• 5.17.9
• 5.17.10
• 5.17.11
• 5.17.12
• 5.17.13
• 5.17.14
• 5.18.0
• 5.18.1
• 5.18.2
• 5.18.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion