CVE-2022-49754

Description

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix a buffer overflow in mgmt_mesh_add() Smatch Warning: net/bluetooth/mgmt_util.c:375 mgmt_mesh_add() error: __memcpy() 'mesh_tx->param' too small (48 vs 50) Analysis: 'mesh_tx->param' is array of size 48. This is the destination. u8 param[sizeof(struct mgmt_cp_mesh_send) + 29]; // 19 + 29 = 48. But in the caller 'mesh_send' we reject only when len > 50. len > (MGMT_MESH_SEND_SIZE + 31) // 19 + 31 = 50.

Reserved 2025-03-27 | Published 2025-03-27 | Updated 2025-05-04 | Assigner Linux

Product status

Default status
unaffected

b338d91703fae6f6afd67f3f75caa3b8f36ddef3 before ed818fd8c531abf561b379995ee7cc4c68029464
affected

b338d91703fae6f6afd67f3f75caa3b8f36ddef3 before 2185e0fdbb2137f22a9dd9fcbf6481400d56299b
affected

Default status
affected

6.1
affected

Any version before 6.1
unaffected

6.1.9
unaffected

6.2
unaffected

References

git.kernel.org/...c/ed818fd8c531abf561b379995ee7cc4c68029464

git.kernel.org/...c/2185e0fdbb2137f22a9dd9fcbf6481400d56299b

cve.org (CVE-2022-49754)

nvd.nist.gov (CVE-2022-49754)

Download JSON