CVE-2022-49031

What it actually does

Out-of-bounds read in afe4403_read_raw due to afe4403_channel_leds array being smaller than the number of channels, allowing chan->address to access invalid memory when reading intensity sysfs attributes.

Why it matters to the business

Local attackers can trigger kernel information disclosure or crashes on systems using the afe4403 IIO driver, leading to potential instability or limited data exposure; low urgency given minimal EPSS and no KEV listing, though kernel memory issues warrant attention on affected hardware.

How an attack unfolds

An attacker with local shell access runs a simple cat command against a specific sysfs intensity attribute, causing the driver to perform an out-of-bounds read that may leak kernel memory or panic the system; unrelated threat actor mentions in reporting do not indicate active exploitation of this specific flaw.

How to fix it

Apply the upstream kernel patch that reorders the channel access check before use in afe4403_read_raw; update to a fixed mainline or distribution kernel containing commit addressing the array size mismatch.

How to confirm the fix worked

Confirm the fix by inspecting the driver source for the reordered access or by verifying the read no longer triggers KASAN reports on the affected sysfs attribute.

Typical attack path

1. Obtain local user access on a Linux system with the afe4403 driver loaded
2. Execute read of /sys/bus/spi/devices/spi0.0/iio:device0/in_intensity6_raw
3. Trigger OOB memory access in afe4403_read_raw

How to detect it

Review kernel logs and KASAN reports for mentions of afe4403_read_raw and global-out-of-bounds reads; check for unexpected crashes when users access IIO sysfs attributes on SPI-connected afe4403 devices.

What your security team should do

• Prioritize kernel updates on systems exposing the afe4403 driver
• Limit untrusted local access where hardware is present
• Monitor kernel logs for related OOB or KASAN events