CVE-2022-48927

What it actually does

The driver incorrectly uses indio_dev->num_channels (which counts physical channels plus the timestamp channel) to size an array allocated only for physical channels, allowing an out-of-bounds write when the timestamp channel is present.

Why it matters to the business

Systems running affected Linux kernels with the TSC2046 ADC driver face risk of local memory corruption that can lead to crashes, privilege escalation, or full system compromise, particularly on embedded and Android devices; the issue was resolved years ago but unpatched kernels remain exposed.

How an attack unfolds

An attacker with local access on a vulnerable system triggers the driver code path that populates the channel array, supplying more channels than the allocated buffer size and overwriting adjacent kernel memory structures.

How to fix it

Upgrade to a kernel containing commit 0cb9b2f73c182d242a640e512f4785c7c504512f or later; Android SoC vendors should apply the 2021-12-05 fix or newer vendor kernels that incorporate the corrected driver logic.

How to confirm the fix worked

Confirm the running kernel source contains the ARRAY_SIZE() change in drivers/iio/adc/tsc2046.c instead of using num_channels for the allocated array; verify the driver no longer references num_channels for physical-channel-only buffers.

Typical attack path

1. Obtain local shell or user context on a system exposing the tsc2046 IIO device
2. Interact with the IIO subsystem to enable channels that include the software timestamp
3. Cause the driver to allocate and populate the undersized array, triggering the overflow
4. Leverage the resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs and crash dumps for oops or warnings originating from tsc2046.c around channel array handling; examine IIO device initialization sequences on systems known to use the TSC2046 ADC.

What your security team should do

• Identify all Linux-based devices and Android builds using the tsc2046 driver and schedule immediate kernel upgrades
• Prioritize patching for any systems still running kernels before the 0cb9b2f commit or the 2021-12-05 SoC fix
• Apply kernel updates via distribution or vendor channels and reboot affected systems
• Monitor for future IIO driver updates in long-term supported kernel branches