Description
In the Linux kernel, the following vulnerability has been resolved: vt_ioctl: fix array_index_nospec in vt_setactivate array_index_nospec ensures that an out-of-bounds value is set to zero on the transient path. Decreasing the value by one afterwards causes a transient integer underflow. vsa.console should be decreased first and then sanitized with array_index_nospec. Kasper Acknowledgements: Jakob Koschel, Brian Johannesmeyer, Kaveh Razavi, Herbert Bos, Cristiano Giuffrida from the VUSec group at VU Amsterdam.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0ec459ec174031fad02a55e622cf2fc0d2e75a25 to < 830c5aa302ec16b4ee641aec769462c37f802c90affected4334a6ae867aa12f01c1755368fd0de4c926ac75 to < 2a45a6bd1e6d651770aafff57ab3e1d3bb0b42e0affectede97267cb4d1ee01ca0929638ec0fcbb0904f903d to < 170325aba4608bde3e7d21c9c19b7bc266ac0885affectede97267cb4d1ee01ca0929638ec0fcbb0904f903d to < ae3d57411562260ee3f4fd5e875f410002341104affectede97267cb4d1ee01ca0929638ec0fcbb0904f903d to < 778302ca09498b448620edd372dc908bebf80bdfaffectede97267cb4d1ee01ca0929638ec0fcbb0904f903d to < ffe54289b02e9c732d6f04c8ebbe3b2d90d32118affectede97267cb4d1ee01ca0929638ec0fcbb0904f903d to < 6550bdf52846f85a2a3726a5aa0c7c4399f2fc02affectede97267cb4d1ee01ca0929638ec0fcbb0904f903d to < 61cc70d9e8ef5b042d4ed87994d20100ec8896d9affected458697ab18b512445ac273ce68a9f8fd623fc0a3affected1aa698b65186c13ed775896ed1dfec7c26c73d60affected52ef74c21c277e50de771fc722d814a830b3036baffected4.9.130 to < 4.9.302affected4.14.73 to < 4.14.267affected3.16.62 to < 3.17affected4.4.159 to < 4.5affected4.18.11 to < 4.19affected
Linux Linux
Default version status: affected
4.19affected0 to < 4.19unaffected4.9.302 to ≤ 4.9.*unaffected4.14.267 to ≤ 4.14.*unaffected4.19.230 to ≤ 4.19.*unaffected5.4.180 to ≤ 5.4.*unaffected5.10.101 to ≤ 5.10.*unaffected5.15.24 to ≤ 5.15.*unaffected5.16.10 to ≤ 5.16.*unaffected5.17 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/830c5aa302ec16b4ee641aec769462c37f802c90 ↗
- https://git.kernel.org/stable/c/2a45a6bd1e6d651770aafff57ab3e1d3bb0b42e0 ↗
- https://git.kernel.org/stable/c/170325aba4608bde3e7d21c9c19b7bc266ac0885 ↗
- https://git.kernel.org/stable/c/ae3d57411562260ee3f4fd5e875f410002341104 ↗
- https://git.kernel.org/stable/c/778302ca09498b448620edd372dc908bebf80bdf ↗
- https://git.kernel.org/stable/c/ffe54289b02e9c732d6f04c8ebbe3b2d90d32118 ↗
- https://git.kernel.org/stable/c/6550bdf52846f85a2a3726a5aa0c7c4399f2fc02 ↗
- https://git.kernel.org/stable/c/61cc70d9e8ef5b042d4ed87994d20100ec8896d9 ↗