Description
In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix a memory corruption iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in bytes, we'll write past the buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
cf29c5b66b9f83939367d90679eb68cdfa2f0356 to < 05dd9facfb9a1e056752c0901c6e86416037d15aaffectedcf29c5b66b9f83939367d90679eb68cdfa2f0356 to < 99a23462fe1a6f709f0fda3ebbe8b6b193ac75bdaffectedcf29c5b66b9f83939367d90679eb68cdfa2f0356 to < aa2cc9363926991ba74411e3aa0a0ea82c1ffe32affectedcf29c5b66b9f83939367d90679eb68cdfa2f0356 to < 870171899d75d43e3d14360f3a4850e90a9c289baffectedcf29c5b66b9f83939367d90679eb68cdfa2f0356 to < f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67affectedcf29c5b66b9f83939367d90679eb68cdfa2f0356 to < cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4daffected
Linux Linux
Default version status: affected
5.5affected0 to < 5.5unaffected5.10.210 to ≤ 5.10.*unaffected5.15.149 to ≤ 5.15.*unaffected6.1.76 to ≤ 6.1.*unaffected6.6.15 to ≤ 6.6.*unaffected6.7.3 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/05dd9facfb9a1e056752c0901c6e86416037d15a ↗
- https://git.kernel.org/stable/c/99a23462fe1a6f709f0fda3ebbe8b6b193ac75bd ↗
- https://git.kernel.org/stable/c/aa2cc9363926991ba74411e3aa0a0ea82c1ffe32 ↗
- https://git.kernel.org/stable/c/870171899d75d43e3d14360f3a4850e90a9c289b ↗
- https://git.kernel.org/stable/c/f32a81999d0b8e5ce60afb5f6a3dd7241c17dd67 ↗
- https://git.kernel.org/stable/c/cf4a0d840ecc72fcf16198d5e9c505ab7d5a5e4d ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗