Description
In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix copy buffer page size For non-registered buffer, fastrpc driver copies the buffer and pass it to the remote subsystem. There is a problem with current implementation of page size calculation which is not considering the offset in the calculation. This might lead to passing of improper and out-of-bounds page size which could result in memory issue. Calculate page start and page end using the offset adjusted address instead of absolute address.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
02b45b47fbe84e23699bb6bdc74d4c2780e282b4 to < c56ba3ea8e3c9a69a992aad18f7a65e43e51d623affected02b45b47fbe84e23699bb6bdc74d4c2780e282b4 to < c0464bad0e85fcd5d47e4297d1e410097c979e55affected02b45b47fbe84e23699bb6bdc74d4c2780e282b4 to < 24a79c6bc8de763f7c50f4f84f8b0c183bc25a51affected02b45b47fbe84e23699bb6bdc74d4c2780e282b4 to < c3f7161123fcbdc64e90119ccce292d8b66281c4affected02b45b47fbe84e23699bb6bdc74d4c2780e282b4 to < e966eae72762ecfdbdb82627e2cda48845b9dd66affected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected6.1.129 to ≤ 6.1.*unaffected6.6.78 to ≤ 6.6.*unaffected6.12.14 to ≤ 6.12.*unaffected6.13.3 to ≤ 6.13.*unaffected6.14 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c56ba3ea8e3c9a69a992aad18f7a65e43e51d623 ↗
- https://git.kernel.org/stable/c/c0464bad0e85fcd5d47e4297d1e410097c979e55 ↗
- https://git.kernel.org/stable/c/24a79c6bc8de763f7c50f4f84f8b0c183bc25a51 ↗
- https://git.kernel.org/stable/c/c3f7161123fcbdc64e90119ccce292d8b66281c4 ↗
- https://git.kernel.org/stable/c/e966eae72762ecfdbdb82627e2cda48845b9dd66 ↗
- https://lists.debian.org/debian-lts-announce/2025/03/msg00028.html ↗