Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2022-49285— iio: accel: mma8452: use the correct logic to get mma8452_data

AI Predicted 4.3 Difficulty: Moderate EPSS 0.25% · P17

Possible ATT&CK Techniques 1AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 8

VendorProductVersion RangeStatus
LinuxLinuxc3cdd6e48e35b7a02f28e301ef30a87ff3cd6527< 4c0bb583a4444cce224e8661090cbffc98e2fe07affected
c3cdd6e48e35b7a02f28e301ef30a87ff3cd6527< d2d9ebdbff79d87d27652578e6d1638ad3b5f3bfaffected
c3cdd6e48e35b7a02f28e301ef30a87ff3cd6527< c87b7b12f48db86ac9909894f4dc0107d7df6375affected
4.4affected
< 4.4unaffected
5.15.54≤ 5.15.*unaffected
5.17.2≤ 5.17.*unaffected
5.18≤ *unaffected
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-49285

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
iio: accel: mma8452: use the correct logic to get mma8452_data
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: iio: accel: mma8452: use the correct logic to get mma8452_data The original logic to get mma8452_data is wrong, the *dev point to the device belong to iio_dev. we can't use this dev to find the correct i2c_client. The original logic happen to work because it finally use dev->driver_data to get iio_dev. Here use the API to_i2c_client() is wrong and make reader confuse. To correct the logic, it should be like this struct mma8452_data *data = iio_priv(dev_get_drvdata(dev)); But after commit 8b7651f25962 ("iio: iio_device_alloc(): Remove unnecessary self drvdata"), the upper logic also can't work. When try to show the avialable scale in userspace, will meet kernel dump, kernel handle NULL pointer dereference. So use dev_to_iio_dev() to correct the logic. Dual fixes tags as the second reflects when the bug was exposed, whilst the first reflects when the original bug was introduced.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mma8452中获取mma8452_data的逻辑错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux c3cdd6e48e35b7a02f28e301ef30a87ff3cd6527 ~ 4c0bb583a4444cce224e8661090cbffc98e2fe07 -
LinuxLinux 4.4 -

II. Public POCs for CVE-2022-49285

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-49285

请登录查看更多情报信息。

Patches & Fixes for CVE-2022-49285 (3)

Same Patch Batch · Linux · 2025-02-26 · 706 CVEs total

CVE-2022-491499.8 CRITICALrxrpc: Fix call timer start racing with call destruction
CVE-2022-495619.8 CRITICALnetfilter: conntrack: re-fetch conntrack after insertion
CVE-2022-494079.8 CRITICALdlm: fix plock invalid read
CVE-2022-493629.8 CRITICALNFSD: Fix potential use-after-free in nfsd_file_put()
CVE-2022-492809.8 CRITICALNFSD: prevent underflow in nfssvc_decode_writeargs()
CVE-2022-493569.8 CRITICALSUNRPC: Trap RDMA segment overflows
CVE-2022-494189.8 CRITICALNFSv4: Fix free of uninitialized nfs4_label on referral lookup.
CVE-2022-490949.8 CRITICALnet/tls: fix slab-out-of-bounds bug in decrypt_internal
CVE-2022-490939.8 CRITICALskbuff: fix coalescing for page_pool fragment recycling
CVE-2022-492609.8 CRITICALcrypto: hisilicon/sec - fix the aead software fallback for engine
CVE-2022-491949.8 CRITICALnet: bcmgenet: Use stronger register read/writes to assure ordering
CVE-2022-492019.8 CRITICALibmvnic: fix race between xmit and reset
CVE-2022-490589.1 CRITICALcifs: potential buffer overflow in handling symlinks
CVE-2022-495358.8 HIGHscsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
CVE-2022-491598.8 HIGHscsi: qla2xxx: Implement ref count for SRB
CVE-2022-491388.8 HIGHBluetooth: hci_event: Ignore multiple conn complete events
CVE-2022-494798.8 HIGHmt76: fix tx status related use-after-free race on station removal
CVE-2022-494708.8 HIGHBluetooth: btmtksdio: fix use-after-free at btmtksdio_recv_event
CVE-2022-491118.8 HIGHBluetooth: Fix use after free in hci_send_acl
CVE-2022-491148.8 HIGHscsi: libfc: Fix use after free in fc_exch_abts_resp()

Showing top 20 of 706 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2022-49285

No comments yet

Leave a comment