CVE-2022-27223

HIGH

Linux Kernel < 4.9.304 - Improper Array Index Validation

Title source: rule
STIX 2.1

Description

In drivers/usb/gadget/udc/udc-xilinx.c in the Linux kernel before 5.16.12, the endpoint index is not validated and might be manipulated by the host for out-of-array access.

References (4)

Core 4
Core References
Mailing List, Release Notes, Vendor Advisory x_refsource_misc
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.16.12
Third Party Advisory x_refsource_confirm
https://security.netapp.com/advisory/ntap-20220419-0001/
Mailing List, Third Party Advisory mailing-list x_refsource_mlist
https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html

Scores

CVSS v3 8.8
EPSS 0.0032
EPSS Percentile 55.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-129
Status published
Products (10)
debian/debian_linux 9.0
linux/linux_kernel 3.18 - 4.9.304
netapp/active_iq_unified_manager
netapp/h300e_firmware
netapp/h300s_firmware
netapp/h410s_firmware
netapp/h500e_firmware
netapp/h500s_firmware
netapp/h700e_firmware
netapp/h700s_firmware
Published Mar 16, 2022
Tracked Since Feb 18, 2026