Description
In the Linux kernel, the following vulnerability has been resolved: net: dsa: fix a crash if ->get_sset_count() fails If ds->ops->get_sset_count() fails then it "count" is a negative error code such as -EOPNOTSUPP. Because "i" is an unsigned int, the negative error code is type promoted to a very high value and the loop will corrupt memory until the system crashes. Fix this by checking for error codes and changing the type of "i" to just int.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
badf3ada60ab8f76f9488dc8f5c0c57f70682f5a to < 0f2cb08c57edefb0e7b5045e0e3e9980a3d3aa37affectedbadf3ada60ab8f76f9488dc8f5c0c57f70682f5a to < ce5355f140a7987011388c7e30c4f8fbe180d3e8affectedbadf3ada60ab8f76f9488dc8f5c0c57f70682f5a to < caff86f85512b8e0d9830e8b8b0dfe13c68ce5b6affectedbadf3ada60ab8f76f9488dc8f5c0c57f70682f5a to < 7b22466648a4f8e3e94f57ca428d1531866d1373affectedbadf3ada60ab8f76f9488dc8f5c0c57f70682f5a to < a269333fa5c0c8e53c92b5a28a6076a28cde3e83affected
Linux Linux
Default version status: affected
4.7affected0 to < 4.7unaffected4.19.193 to ≤ 4.19.*unaffected5.4.124 to ≤ 5.4.*unaffected5.10.42 to ≤ 5.10.*unaffected5.12.9 to ≤ 5.12.*unaffected5.13 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0f2cb08c57edefb0e7b5045e0e3e9980a3d3aa37 ↗
- https://git.kernel.org/stable/c/ce5355f140a7987011388c7e30c4f8fbe180d3e8 ↗
- https://git.kernel.org/stable/c/caff86f85512b8e0d9830e8b8b0dfe13c68ce5b6 ↗
- https://git.kernel.org/stable/c/7b22466648a4f8e3e94f57ca428d1531866d1373 ↗
- https://git.kernel.org/stable/c/a269333fa5c0c8e53c92b5a28a6076a28cde3e83 ↗