Description
In the Linux kernel, the following vulnerability has been resolved: scsi: bfa: Ensure the copied buf is NUL terminated Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from userspace to that buffer. Later, we use sscanf on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using sscanf. Fix this issue by using memdup_user_nul instead of memdup_user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9f30b674759b9a2da25aefe25d885161d8a911cb to < 481fc0c8617304a67649027c4a44723a139a0462affected9f30b674759b9a2da25aefe25d885161d8a911cb to < 595a6b98deec01b6dbb20139f71edcd5fb760ec2affected9f30b674759b9a2da25aefe25d885161d8a911cb to < 00b425ff0891283207d7bad607a2412225274d7aaffected9f30b674759b9a2da25aefe25d885161d8a911cb to < 1708e3cf2488788cba5489e4f913d227de757bafaffected9f30b674759b9a2da25aefe25d885161d8a911cb to < 7d3e694c4fe30f3aba9cd5ae86fb947a54c3db5caffected9f30b674759b9a2da25aefe25d885161d8a911cb to < 204714e68015d6946279719fd464ecaf57240f35affected9f30b674759b9a2da25aefe25d885161d8a911cb to < 7510fab46b1cbd1680e2a096e779aec3334b4143affected9f30b674759b9a2da25aefe25d885161d8a911cb to < ecb76200f5557a2886888aaa53702da1ab9e6cdfaffected9f30b674759b9a2da25aefe25d885161d8a911cb to < 13d0cecb4626fae67c00c84d3c7851f6b62f7df3affected
Linux Linux
Default version status: affected
3.19affected0 to < 3.19unaffected4.19.316 to ≤ 4.19.*unaffected5.4.278 to ≤ 5.4.*unaffected5.10.219 to ≤ 5.10.*unaffected5.15.161 to ≤ 5.15.*unaffected6.1.93 to ≤ 6.1.*unaffected6.6.33 to ≤ 6.6.*unaffected6.8.12 to ≤ 6.8.*unaffected6.9.3 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/481fc0c8617304a67649027c4a44723a139a0462 ↗
- https://git.kernel.org/stable/c/595a6b98deec01b6dbb20139f71edcd5fb760ec2 ↗
- https://git.kernel.org/stable/c/00b425ff0891283207d7bad607a2412225274d7a ↗
- https://git.kernel.org/stable/c/1708e3cf2488788cba5489e4f913d227de757baf ↗
- https://git.kernel.org/stable/c/7d3e694c4fe30f3aba9cd5ae86fb947a54c3db5c ↗
- https://git.kernel.org/stable/c/204714e68015d6946279719fd464ecaf57240f35 ↗
- https://git.kernel.org/stable/c/7510fab46b1cbd1680e2a096e779aec3334b4143 ↗
- https://git.kernel.org/stable/c/ecb76200f5557a2886888aaa53702da1ab9e6cdf ↗
- https://git.kernel.org/stable/c/13d0cecb4626fae67c00c84d3c7851f6b62f7df3 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-265688.html ↗