Description
In the Linux kernel, the following vulnerability has been resolved: crypto: cavium - prevent integer overflow loading firmware The "code_length" value comes from the firmware file. If your firmware is untrusted realistically there is probably very little you can do to protect yourself. Still we try to limit the damage as much as possible. Also Smatch marks any data read from the filesystem as untrusted and prints warnings if it not capped correctly. The "ntohl(ucode->code_length) * 2" multiplication can have an integer overflow.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9e2c7d99941d000a36f68a3594cec27a1bbea274 to < c4d4c2afd08dfb3cd1c880d1811ede2568e81a6daffected9e2c7d99941d000a36f68a3594cec27a1bbea274 to < 90e483e7f20c32287d2a9da967e122938f52737aaffected9e2c7d99941d000a36f68a3594cec27a1bbea274 to < 584561e94260268abe1c83e00d9c205565cb7bc5affected9e2c7d99941d000a36f68a3594cec27a1bbea274 to < 3a720eb89026c5241b8c4abb33370dc6fb565eeeaffected9e2c7d99941d000a36f68a3594cec27a1bbea274 to < 172c8a24fc8312cf6b88d3c88469653fdcb1c127affected9e2c7d99941d000a36f68a3594cec27a1bbea274 to < 371fa5129af53a79f6dddc90fe5bb0825cbe72a4affected9e2c7d99941d000a36f68a3594cec27a1bbea274 to < e29fd7a6852376d2cfb95ad5d6d3eeff93f815e9affected9e2c7d99941d000a36f68a3594cec27a1bbea274 to < 2526d6bf27d15054bb0778b2f7bc6625fd934905affected
Linux Linux
Default version status: affected
4.11affected0 to < 4.11unaffected4.14.296 to ≤ 4.14.*unaffected4.19.262 to ≤ 4.19.*unaffected5.4.220 to ≤ 5.4.*unaffected5.10.150 to ≤ 5.10.*unaffected5.15.75 to ≤ 5.15.*unaffected5.19.17 to ≤ 5.19.*unaffected6.0.3 to ≤ 6.0.*unaffected6.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c4d4c2afd08dfb3cd1c880d1811ede2568e81a6d ↗
- https://git.kernel.org/stable/c/90e483e7f20c32287d2a9da967e122938f52737a ↗
- https://git.kernel.org/stable/c/584561e94260268abe1c83e00d9c205565cb7bc5 ↗
- https://git.kernel.org/stable/c/3a720eb89026c5241b8c4abb33370dc6fb565eee ↗
- https://git.kernel.org/stable/c/172c8a24fc8312cf6b88d3c88469653fdcb1c127 ↗
- https://git.kernel.org/stable/c/371fa5129af53a79f6dddc90fe5bb0825cbe72a4 ↗
- https://git.kernel.org/stable/c/e29fd7a6852376d2cfb95ad5d6d3eeff93f815e9 ↗
- https://git.kernel.org/stable/c/2526d6bf27d15054bb0778b2f7bc6625fd934905 ↗