Description
In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities. These functions parse ACPI packages into internal data structures using a for loop with index variable 'elem' that iterates through enum_obj/integer_obj/order_obj/password_obj/string_obj arrays. When processing multi-element fields like PREREQUISITES and ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array elements using expressions like 'enum_obj[elem + reqs]' and 'enum_obj[elem + pos_values]' within nested loops. The bug is that the bounds check only validated elem, but did not consider the additional offset when accessing elem + reqs or elem + pos_values. The fix changes the bounds check to validate the actual accessed index.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
e6c7b3e15559699a30646dd45195549c7db447bd to < cf7ae870560b988247a4bbbe5399edd326632680affectede6c7b3e15559699a30646dd45195549c7db447bd to < db4c26adf7117b1a4431d1197ae7109fee3230adaffectede6c7b3e15559699a30646dd45195549c7db447bd to < 79cab730dbaaac03b946c7f5681bd08c986e2abdaffectede6c7b3e15559699a30646dd45195549c7db447bd to < e44c42c830b7ab36e3a3a86321c619f24def5206affected
Linux Linux
Default version status: affected
6.6affected0 to < 6.6unaffected6.6.120 to ≤ 6.6.*unaffected6.12.64 to ≤ 6.12.*unaffected6.18.4 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected