Array Index Out of Bounds Vulnerability in Linux Kernel Affecting AHCI Driver

CVE-2022-50315

What is CVE-2022-50315?

A vulnerability in the Linux kernel's AHCI driver is caused by a mismatch between the maximum slots defined and the number of Enclosure Management ports initialized. The function 'sata_pmp_init_links()' initializes links beyond the configured array size, leading to potential array index out of bounds errors. This issue can affect systems utilizing SATA Port Multiplier configurations, necessitating an update to align the EM_MAX_SLOTS with SATA_PMP_MAX_PORTS to mitigate the risk.

References