Description
In the Linux kernel, the following vulnerability has been resolved: iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw KASAN report out-of-bounds read as follows: BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278 Call Trace: afe4404_read_raw iio_read_channel_info dev_attr_show The buggy address belongs to the variable: afe4404_channel_leds+0x18/0xffffffffffffe9c0 This issue can be reproduce by singe command: $ cat /sys/bus/i2c/devices/0-0058/iio\:device0/in_intensity6_raw The array size of afe4404_channel_leds and afe4404_channel_offdacs are less than channels, so access with chan->address cause OOB read in afe4404_[read|write]_raw. Fix it by moving access before use them.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b36e8257641a043764c62240316610c81e36376c to < 68de7da092f38395dde523f2e5db26eba6c23e28affectedb36e8257641a043764c62240316610c81e36376c to < 113c08030a89aaf406f8a1d4549d758a67c2afbaaffectedb36e8257641a043764c62240316610c81e36376c to < f5575041ec15310bdc50c42b8b22118cc900226eaffectedb36e8257641a043764c62240316610c81e36376c to < 3f566b626029ca8598d48e5074e56bb37399ca1baffectedb36e8257641a043764c62240316610c81e36376c to < 5eb114f55b37dbc0487aa9c1913b81bb7837f1c4affectedb36e8257641a043764c62240316610c81e36376c to < f7419fc42afc035f6b29ce713e17dcd2000c833faffectedb36e8257641a043764c62240316610c81e36376c to < d45d9f45e7b1365fd0d9bf14680d6d5082a590d1affectedb36e8257641a043764c62240316610c81e36376c to < fc92d9e3de0b2d30a3ccc08048a5fad533e4672baffected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected4.9.335 to ≤ 4.9.*unaffected4.14.301 to ≤ 4.14.*unaffected4.19.268 to ≤ 4.19.*unaffected5.4.226 to ≤ 5.4.*unaffected5.10.158 to ≤ 5.10.*unaffected5.15.82 to ≤ 5.15.*unaffected6.0.12 to ≤ 6.0.*unaffected6.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/68de7da092f38395dde523f2e5db26eba6c23e28 ↗
- https://git.kernel.org/stable/c/113c08030a89aaf406f8a1d4549d758a67c2afba ↗
- https://git.kernel.org/stable/c/f5575041ec15310bdc50c42b8b22118cc900226e ↗
- https://git.kernel.org/stable/c/3f566b626029ca8598d48e5074e56bb37399ca1b ↗
- https://git.kernel.org/stable/c/5eb114f55b37dbc0487aa9c1913b81bb7837f1c4 ↗
- https://git.kernel.org/stable/c/f7419fc42afc035f6b29ce713e17dcd2000c833f ↗
- https://git.kernel.org/stable/c/d45d9f45e7b1365fd0d9bf14680d6d5082a590d1 ↗
- https://git.kernel.org/stable/c/fc92d9e3de0b2d30a3ccc08048a5fad533e4672b ↗