CVE-2022-49032

What it actually does

Out-of-bounds read in the Linux kernel IIO afe4404 driver when handling raw channel reads/writes due to array size of afe4404_channel_leds and afe4404_channel_offdacs being smaller than the number of channels, allowing chan->address to access beyond bounds.

Why it matters to the business

May cause kernel panics or limited memory disclosure on systems using AFE4404 health sensors, resulting in denial of service for affected devices and potential exposure of kernel memory contents.

How an attack unfolds

An attacker with local user access on an affected Linux system reads a specific sysfs intensity attribute (such as in_intensity6_raw) which invokes afe4404_read_raw and triggers the out-of-bounds access; the flaw was publicly disclosed and referenced in broader 2024 kernel exploitation campaigns by espionage and financially motivated actors.

How to fix it

Update the Linux kernel to a version containing commit 68de7da092f38395dde523f2e5db26eba6c23e28 (or equivalent stable backports) which moves channel access before use of the undersized arrays.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit, then attempt to read the previously crashing sysfs attribute while monitoring for absence of KASAN global-out-of-bounds reports.

Typical attack path

1. Obtain local shell access on a system exposing the afe4404 IIO device
2. Locate the iio:device sysfs entry for the sensor
3. Read a high-numbered intensity raw attribute to trigger the OOB access
4. Observe kernel oops, KASAN report, or attempt to leverage any disclosed data

How to detect it

Search kernel logs (dmesg, journalctl) for KASAN reports containing afe4404_read_raw, global-out-of-bounds, and references to afe4404_channel_leds; correlate with sysfs reads of intensity raw attributes on i2c-connected IIO devices.

• BUG: KASAN: global-out-of-bounds in afe4404_read_raw
• afe4404_channel_leds+0x18
• /sys/bus/i2c/devices/.*/iio:device.*/in_intensity6_raw
• Read of size 4 at addr ffffffffc00e4658

What your security team should do

• Prioritize kernel updates on any systems exposing AFE4404 or similar IIO health sensors
• Audit kernel logs for historical KASAN reports mentioning afe4404_read_raw
• Restrict unprivileged access to IIO sysfs entries where feasible until patched
• Track downstream dependents of the linux kernel git tree for rapid propagation of the fix