Description
In the Linux kernel, the following vulnerability has been resolved: kdb: Fix buffer overflow during tab-complete Currently, when the user attempts symbol completion with the Tab key, kdb will use strncpy() to insert the completed symbol into the command buffer. Unfortunately it passes the size of the source buffer rather than the destination to strncpy() with predictably horrible results. Most obviously if the command buffer is already full but cp, the cursor position, is in the middle of the buffer, then we will write past the end of the supplied buffer. Fix this by replacing the dubious strncpy() calls with memmove()/memcpy() calls plus explicit boundary checks to make sure we have enough space before we start moving characters around.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < fb824a99e148ff272a53d71d84122728b5f00992affected5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < ddd2972d8e2dee3b33e8121669d55def59f0be8aaffected5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < cfdc2fa4db57503bc6d3817240547c8ddc55fa96affected5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < f636a40834d22e5e3fc748f060211879c056cd33affected5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < 33d9c814652b971461d1e30bead6792851c209e7affected5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < 107e825cc448b7834b31e8b1b3cf0f57426d46d5affected5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < f694da720dcf795dc3eb97bf76d220213f76aaa7affected5d5314d6795f3c1c0f415348ff8c51f7de042b77 to < e9730744bf3af04cda23799029342aa3cddbc454affected
Linux Linux
Default version status: affected
2.6.35affected0 to < 2.6.35unaffected4.19.316 to ≤ 4.19.*unaffected5.4.278 to ≤ 5.4.*unaffected5.10.219 to ≤ 5.10.*unaffected5.15.161 to ≤ 5.15.*unaffected6.1.94 to ≤ 6.1.*unaffected6.6.34 to ≤ 6.6.*unaffected6.9.5 to ≤ 6.9.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fb824a99e148ff272a53d71d84122728b5f00992 ↗
- https://git.kernel.org/stable/c/ddd2972d8e2dee3b33e8121669d55def59f0be8a ↗
- https://git.kernel.org/stable/c/cfdc2fa4db57503bc6d3817240547c8ddc55fa96 ↗
- https://git.kernel.org/stable/c/f636a40834d22e5e3fc748f060211879c056cd33 ↗
- https://git.kernel.org/stable/c/33d9c814652b971461d1e30bead6792851c209e7 ↗
- https://git.kernel.org/stable/c/107e825cc448b7834b31e8b1b3cf0f57426d46d5 ↗
- https://git.kernel.org/stable/c/f694da720dcf795dc3eb97bf76d220213f76aaa7 ↗
- https://git.kernel.org/stable/c/e9730744bf3af04cda23799029342aa3cddbc454 ↗