CVE-2022-48672

of: fdt: fix off-by-one error in unflatten_dt_nodes()

HIGH

7.8

CVSS Score

Published: May 3, 2024 at 02:51 PM UTC

Updated: June 17, 2026 at 05:15 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.2%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: of: fdt: fix off-by-one error in unflatten_dt_nodes() Commit 78c44d910d3e ("drivers/of: Fix depth when unflattening devicetree") forgot to fix up the depth check in the loop body in unflatten_dt_nodes() which makes it possible to overflow the nps[] buffer... Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.15 ≤ v < 4.19.2604.20 ≤ v < 5.4.2154.7 ≤ v < 4.14.2954.7 ≤ v < 4.19.2604.7 ≤ v < 5.10.1454.7 ≤ v < 5.15.704.7 ≤ v < 5.19.114.7 ≤ v < 5.4.2154.7 ≤ v < 6.05.11 ≤ v < 5.15.705.16 ≤ v < 5.19.115.5 ≤ v < 5.10.1454.778c44d910d3e5f96dc6b3695fc1e4efd7c46a455

Vendor states this is fixed in 2133f451311671c7c42b5640d2b999326b39aa0e (fixed)

Vendor states this is fixed in 2566706ac6393386a4e7c4ce23fe17f4c98d9aa0 (fixed)

Vendor states this is fixed in 2f945a792f67815abca26fa8a5e863ccf3fa1181 (fixed)

Vendor states this is fixed in ba6b9f7cc1108bad6e2c53b1d6e0156379188db7 (fixed)

Vendor states this is fixed in cbdda20ce363356698835185801a58a28f644853 (fixed)

Vendor states this is fixed in e0e88c25f88b9805572263c9ed20f1d88742feaf (fixed)

Vendor states this is fixed in ee4369260e77821602102dcc7d792de39a56365c (fixed)

Vendor states this is fixed in 4.14.295 (unaffected)

Vendor states this is fixed in 4.19.260 (unaffected)

Vendor states this is fixed in 4.7 (unaffected)

Vendor states this is fixed in 5.10.145 (unaffected)

Vendor states this is fixed in 5.15.70 (unaffected)