Description
In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4403: Fix oob read in afe4403_read_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4403_read_raw+0x42e/0x4c0 Read of size 4 at addr ffffffffc02ac638 by task cat/279 Call Trace: afe4403_read_raw iio_read_channel_info dev_attr_show The buggy address belongs to the variable: afe4403_channel_leds+0x18/0xffffffffffffe9e0 This issue can be reproduced by singe command: $ cat /sys/bus/spi/devices/spi0.0/iio\:device0/in_intensity6_raw The array size of afe4403_channel_leds is less than channels, so access with chan->address cause OOB read in afe4403_read_raw. Fix it by moving access before use it.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b36e8257641a043764c62240316610c81e36376c to < 98afcb5f3be645d330c74c5194ba0d80e26f95e0affectedb36e8257641a043764c62240316610c81e36376c to < c9268df36818ee4eaaaeadc80009b442a5ca69c9affectedb36e8257641a043764c62240316610c81e36376c to < 726fa3e4ab97dcff1c745bdc4fb137366cb8d3dfaffectedb36e8257641a043764c62240316610c81e36376c to < 2d6a437064ffbe685c67ddb16dfc0946074c6c3faffectedb36e8257641a043764c62240316610c81e36376c to < b1756af172fb80a3edc143772d49e166ec691b6caffectedb36e8257641a043764c62240316610c81e36376c to < e7e76a77aabef8989cbc0a8417af1aa040620867affectedb36e8257641a043764c62240316610c81e36376c to < 06c6ce21cec77dfa860d57e7a006000a57812efbaffectedb36e8257641a043764c62240316610c81e36376c to < 58143c1ed5882c138a3cd2251a336fc8755f23d9affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected4.9.335 to ≤ 4.9.*unaffected4.14.301 to ≤ 4.14.*unaffected4.19.268 to ≤ 4.19.*unaffected5.4.226 to ≤ 5.4.*unaffected5.10.158 to ≤ 5.10.*unaffected5.15.82 to ≤ 5.15.*unaffected6.0.12 to ≤ 6.0.*unaffected6.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/98afcb5f3be645d330c74c5194ba0d80e26f95e0 ↗
- https://git.kernel.org/stable/c/c9268df36818ee4eaaaeadc80009b442a5ca69c9 ↗
- https://git.kernel.org/stable/c/726fa3e4ab97dcff1c745bdc4fb137366cb8d3df ↗
- https://git.kernel.org/stable/c/2d6a437064ffbe685c67ddb16dfc0946074c6c3f ↗
- https://git.kernel.org/stable/c/b1756af172fb80a3edc143772d49e166ec691b6c ↗
- https://git.kernel.org/stable/c/e7e76a77aabef8989cbc0a8417af1aa040620867 ↗
- https://git.kernel.org/stable/c/06c6ce21cec77dfa860d57e7a006000a57812efb ↗
- https://git.kernel.org/stable/c/58143c1ed5882c138a3cd2251a336fc8755f23d9 ↗