Description
In the Linux kernel, the following vulnerability has been resolved: Input: iforce - invert valid length check when fetching device IDs syzbot is reporting uninitialized value at iforce_init_device() [1], for commit 6ac0aec6b0a6 ("Input: iforce - allow callers supply data buffer when fetching device IDs") is checking that valid length is shorter than bytes to read. Since iforce_get_id_packet() stores valid length when returning 0, the caller needs to check that valid length is longer than or equals to bytes to read.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6ac0aec6b0a651d64eef759fddf17d9145b51033 to < 5d53797ce7ce8fb1d95a5bebc5efa9418c4217a3affected6ac0aec6b0a651d64eef759fddf17d9145b51033 to < 24cc679abbf31477d0cc6106ec83c2fbae6b3cdfaffected6ac0aec6b0a651d64eef759fddf17d9145b51033 to < fdd57c20d4408cac3c3c535c120d244e083406c9affected6ac0aec6b0a651d64eef759fddf17d9145b51033 to < 6365569d62a75ddf53fb0c2936c16587a365984caffected6ac0aec6b0a651d64eef759fddf17d9145b51033 to < b8ebf250997c5fb253582f42bfe98673801ebebdaffected
Linux Linux
Default version status: affected
5.3affected0 to < 5.3unaffected5.4.225 to ≤ 5.4.*unaffected5.10.156 to ≤ 5.10.*unaffected5.15.80 to ≤ 5.15.*unaffected6.0.10 to ≤ 6.0.*unaffected6.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/5d53797ce7ce8fb1d95a5bebc5efa9418c4217a3 ↗
- https://git.kernel.org/stable/c/24cc679abbf31477d0cc6106ec83c2fbae6b3cdf ↗
- https://git.kernel.org/stable/c/fdd57c20d4408cac3c3c535c120d244e083406c9 ↗
- https://git.kernel.org/stable/c/6365569d62a75ddf53fb0c2936c16587a365984c ↗
- https://git.kernel.org/stable/c/b8ebf250997c5fb253582f42bfe98673801ebebd ↗