linux-cve-announce - CVE-2022-50649: power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025120937-CVE-2022-50649-6a84@gregkh>
Date: Tue,  9 Dec 2025 09:01:50 +0900
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2022-50649: power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

power: supply: adp5061: fix out-of-bounds read in adp5061_get_chg_type()

ADP5061_CHG_STATUS_1_CHG_STATUS is masked with 0x07, which means a length
of 8, but adp5061_chg_type array size is 4, may end up reading 4 elements
beyond the end of the adp5061_chg_type[] array.

The Linux kernel CVE team has assigned CVE-2022-50649 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.262 with commit 24a0be36e9a21f63de2e6088607e689e59ec15f4
	Fixed in 5.4.220 with commit 3376a0cf138dfc90b449fde541ca228a33e1c143
	Fixed in 5.10.150 with commit 89f305a71418591cdda18180f712f91c9820f03b
	Fixed in 5.15.75 with commit 7c8bc374659de19d846f7cab3eda9ebdb005c4cc
	Fixed in 5.19.17 with commit 038e4aa71281d0cbc8aeb56ba05ff7fc5653a106
	Fixed in 6.0.3 with commit dc52b73d3acd676ccbb440fcec617c547b903af2
	Fixed in 6.1 with commit 9d47e01b9d807808224347935562f7043a358054

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2022-50649
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/power/supply/adp5061.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/24a0be36e9a21f63de2e6088607e689e59ec15f4
	https://git.kernel.org/stable/c/3376a0cf138dfc90b449fde541ca228a33e1c143
	https://git.kernel.org/stable/c/89f305a71418591cdda18180f712f91c9820f03b
	https://git.kernel.org/stable/c/7c8bc374659de19d846f7cab3eda9ebdb005c4cc
	https://git.kernel.org/stable/c/038e4aa71281d0cbc8aeb56ba05ff7fc5653a106
	https://git.kernel.org/stable/c/dc52b73d3acd676ccbb440fcec617c547b903af2
	https://git.kernel.org/stable/c/9d47e01b9d807808224347935562f7043a358054