CVE-2022-50778

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains an issue related to the compiletime strlen() function when used with CONFIG FORTIFY=y and CONFIG UBSAN LOCAL BOUNDS=y. The issue arises from how builtin object size() handles strings with runtime-dependent values, potentially leading to out-of-bounds access during runtime checks. Specifically, the function may attempt to access memory beyond the allocated buffer size in certain scenarios, triggering a runtime panic. This was observed during Android Compatibility Test Suite (CTS) tests. The issue is related to a strlen() call within the hidinput allocate() function. The function uses a local C string whose value depends on a switch statement, causing builtin object size() to evaluate to the maximum string length, leading to the out-of-bounds access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.