Description
In the Linux kernel, the following vulnerability has been resolved: comedi: me4000: Fix potential overrun of firmware buffer `me4000_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`. Note: The firmware loading was totally broken before commit ac584af59945 ("staging: comedi: me4000: fix firmware downloading"), but that is the most sensible target for this fix.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ac584af599452748187cf6d7865b1607c54ee443 to < 8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6affectedac584af599452748187cf6d7865b1607c54ee443 to < 64b24b713e1a3ea6624480594b4f8c2ff86502f2affectedac584af599452748187cf6d7865b1607c54ee443 to < f72b5567f7c117b46b4058dc6a0c7554f8565561affectedac584af599452748187cf6d7865b1607c54ee443 to < 1603dd471f47762e9d1f52304edb3e49a7e62655affectedac584af599452748187cf6d7865b1607c54ee443 to < 99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5affectedac584af599452748187cf6d7865b1607c54ee443 to < eae19cab44204537f79146f15a51811b13227c38affectedac584af599452748187cf6d7865b1607c54ee443 to < de3f923ae7d91480ed3ecea1b1e1fc0dc25b597daffectedac584af599452748187cf6d7865b1607c54ee443 to < 3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7affected
Linux Linux
Default version status: affected
3.19affected0 to < 3.19unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8ddfe6495c245226a30d8b36e2f4a7aa7712e8d6 ↗
- https://git.kernel.org/stable/c/64b24b713e1a3ea6624480594b4f8c2ff86502f2 ↗
- https://git.kernel.org/stable/c/f72b5567f7c117b46b4058dc6a0c7554f8565561 ↗
- https://git.kernel.org/stable/c/1603dd471f47762e9d1f52304edb3e49a7e62655 ↗
- https://git.kernel.org/stable/c/99f31aa98ab6e3805c455b65bcd01b3d48bdf1a5 ↗
- https://git.kernel.org/stable/c/eae19cab44204537f79146f15a51811b13227c38 ↗
- https://git.kernel.org/stable/c/de3f923ae7d91480ed3ecea1b1e1fc0dc25b597d ↗
- https://git.kernel.org/stable/c/3fb43a7a5b44713f892c58ead2e5f3a1bc9f4ee7 ↗