CVE-2022-48948

What it actually does

The flaw permits a 4-byte overflow when the uvc_function_setup handler receives a control transfer payload up to 64 bytes and the data-stage handler copies req->actual bytes via memcpy into a 60-byte uvc_event->data.data buffer.

Why it matters to the business

Linux-based USB gadget devices that expose UVC interfaces face risk of crashes, memory corruption, or potential code execution, which can disrupt embedded systems, IoT appliances, or any downstream products relying on the affected kernel code; low EPSS and absence from KEV indicate limited observed exploitation so far.

How an attack unfolds

An attacker with the ability to issue USB control transfers to a vulnerable UVC gadget function sends an OUT setup request containing more than 60 bytes; the memcpy in the data-stage handler then overwrites adjacent stack or heap memory, enabling memory corruption that may be leveraged for denial of service or, under specific memory layouts, arbitrary code execution. Mentions of 2024 zero-day campaigns and Linux kernel out-of-bounds write activity provide contextual threat-actor interest but no confirmed public exploits for this instance.

How to fix it

Update the Linux kernel to a version containing the fix or apply the equivalent patch; for iredmail/iredadmin (GIT) deployments, update to commit 3c72b438d412ea3ee0270f6956e19b1098c19191.

How to confirm the fix worked

Verify the patched kernel source contains the corrected size check or bounds handling in uvc_function_setup and the data-stage handler; confirm the running kernel version is newer than the vulnerable commit and test with a control transfer exceeding 60 bytes to ensure no overflow occurs.

Typical attack path

1. Identify a Linux system exposing a UVC USB gadget interface
2. Craft and send a control transfer setup packet with payload exceeding 60 bytes
3. Trigger the data-stage memcpy that overflows the 60-byte target buffer
4. Leverage the resulting memory corruption for crash or code execution

How to detect it

Review kernel logs for uvc gadget oops or panic messages referencing the setup handler or data buffer; inspect USB traffic captures for control transfers to UVC endpoints with payload lengths greater than 60 bytes; correlate with any process crashes in usb-gadget or uvc modules.

What your security team should do

• Prioritize kernel updates on all systems exposing UVC gadget functionality
• Apply the specific commit 3c72b438d412ea3ee0270f6956e19b1098c19191 where iredmail/iredadmin is in use
• Monitor EPSS trend and threat-actor reports for any increase in exploitation activity
• Restrict USB gadget exposure to trusted hosts until patches are deployed