CVE-2022-48836— Input: aiptek - properly check endpoint type
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-48836
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Input: aiptek - properly check endpoint type
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: Input: aiptek - properly check endpoint type Syzbot reported warning in usb_submit_urb() which is caused by wrong endpoint type. There was a check for the number of endpoints, but not for the type of endpoint. Fix it by replacing old desc.bNumEndpoints check with usb_find_common_endpoints() helper for finding endpoints Fail log: usb 5-1: BOGUS urb xfer, pipe 1 != type 3 WARNING: CPU: 2 PID: 48 at drivers/usb/core/urb.c:502 usb_submit_urb+0xed2/0x18a0 drivers/usb/core/urb.c:502 Modules linked in: CPU: 2 PID: 48 Comm: kworker/2:2 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Workqueue: usb_hub_wq hub_event ... Call Trace: <TASK> aiptek_open+0xd5/0x130 drivers/input/tablet/aiptek.c:830 input_open_device+0x1bb/0x320 drivers/input/input.c:629 kbd_connect+0xfe/0x160 drivers/tty/vt/keyboard.c:1593
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于Input:aiptek模块中发现端点类型检查问题。在usb_submit_urb函数中，错误地检查了端点数量，而不是端点类型。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-48836
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-48836
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-07-16 · 98 CVEs total
| CVE-2022-48831 | ima: fix reference leak in asymmetric_verify() | |
| CVE-2022-48825 | scsi: qedf: Add stag_work to all the vports | |
| CVE-2022-48821 | misc: fastrpc: avoid double fput() on failed usercopy | |
| CVE-2022-48819 | tcp: take care of mixed splice()/sendmsg(MSG_ZEROCOPY) case | |
| CVE-2022-48820 | phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable() | |
| CVE-2022-48818 | net: dsa: mv88e6xxx: don't use devres for mdiobus | |
| CVE-2022-48817 | net: dsa: ar9331: register the mdiobus under devres | |
| CVE-2022-48822 | usb: f_fs: Fix use-after-free for epfile | |
| CVE-2022-48828 | NFSD: Fix ia_size underflow | |
| CVE-2022-48830 | can: isotp: fix potential CAN frame reception race in isotp_rcv() | |
| CVE-2022-48829 | NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes | |
| CVE-2022-48832 | audit: don't deref the syscall args when checking the openat2 open_how::flags | |
| CVE-2022-48834 | usb: usbtmc: Fix bug in pipe direction for control transfers | |
| CVE-2022-48833 | btrfs: skip reserved bytes warning on unmount after log cleanup failure | |
| CVE-2022-48835 | scsi: mpt3sas: Page fault in reply q processing | |
| CVE-2022-48837 | usb: gadget: rndis: prevent integer overflow in rndis_set_response() | |
| CVE-2022-48838 | usb: gadget: Fix use-after-free bug by not setting udc->dev.driver | |
| CVE-2022-48839 | net/packet: fix slab-out-of-bounds access in packet_recvmsg() | |
| CVE-2022-48840 | iavf: Fix hang during reboot/shutdown | |
| CVE-2022-48842 | ice: Fix race condition during interface enslave |
Showing top 20 of 98 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2022-48836
No comments yet