CVE-2022-48871

What it actually does

Driver allocates RX FIFO buffer at probe time using default depth but later updates rx_fifo_depth to actual hardware value without resizing the buffer, allowing handle_rx_uart to write beyond allocated slab memory.

Why it matters to the business

Systems using affected Qualcomm serial hardware (notably Bluetooth HCI UART) may experience kernel crashes or memory corruption, leading to device instability or potential local privilege escalation on Android and Linux platforms.

How an attack unfolds

An attacker with local access or ability to trigger serial RX events on a vulnerable Qualcomm-based device causes the UART handler to read more words than the original buffer allocation, resulting in an out-of-bounds write observable under KASAN; no widespread remote exploitation known.

How to fix it

Update Linux kernel to commit 894681682dbefdad917b88f86cde1069140a047a or later; apply Android security patches dated 2023-05-01 for frameworks/base, frameworks/native, PackageInstaller, and Permission modules across versions 11, 12, 12L, and 13-next.

How to confirm the fix worked

Verify kernel version contains the referenced commit; confirm Android security patch level includes 2023-05-01 fixes; test affected Qualcomm Bluetooth configurations for absence of KASAN slab-out-of-bounds reports during serial startup.

Typical attack path

1. Obtain local code execution or physical access on target device
2. Trigger Bluetooth or serial initialization that updates RX FIFO depth
3. Induce repeated RX UART handling to exceed buffer bounds
4. Exploit resulting slab corruption for escalation or cause denial of service

How to detect it

Review kernel logs for KASAN slab-out-of-bounds reports in handle_rx_uart or qcom_geni_serial_handle_rx during Bluetooth or serial initialization; inspect dmesg and audit logs for unexpected crashes on affected hardware.

What your security team should do

• Prioritize kernel and Android updates on all Qualcomm-based devices within 30 days
• Monitor vendor advisories for downstream distributions and embedded products
• Restrict untrusted local access on affected hardware until patched