Description
In the Linux kernel, the following vulnerability has been resolved: comedi: me_daq: Fix potential overrun of firmware buffer `me2600_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the first 4 bytes into variable `file_length` and reads the data stream contents of length `file_length` from offset 16 onwards. Although it checks that the supplied firmware is at least 16 bytes long, it does not check that it is long enough to contain the data stream. Add a test to ensure that the supplied firmware is long enough to contain the header and the data stream. On failure, log an error and return `-EINVAL`.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
85acac61096f946a78cf0c4b65f7cebe580693b6 to < 2fc25a4c2e055cd42ea39a1b42c89bfef70e0319affected85acac61096f946a78cf0c4b65f7cebe580693b6 to < 9f39fa07259eb342908e4aa0271dee038a8ce4f8affected85acac61096f946a78cf0c4b65f7cebe580693b6 to < f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8affected85acac61096f946a78cf0c4b65f7cebe580693b6 to < c16ac4e173a05011437a2d868f70cc415339065aaffected85acac61096f946a78cf0c4b65f7cebe580693b6 to < 1bf8761eb59e94bf7b8c17b2a1ee48f14378b172affected85acac61096f946a78cf0c4b65f7cebe580693b6 to < a47ae40339c1048f519df33ff8840731720f57cbaffected85acac61096f946a78cf0c4b65f7cebe580693b6 to < c8c607a77aab783f2e38cc2e0f24aa6c8f6d200baffected85acac61096f946a78cf0c4b65f7cebe580693b6 to < cc797d4821c754c701d9714b58bea947e31dbbe0affected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2fc25a4c2e055cd42ea39a1b42c89bfef70e0319 ↗
- https://git.kernel.org/stable/c/9f39fa07259eb342908e4aa0271dee038a8ce4f8 ↗
- https://git.kernel.org/stable/c/f3f8ec00cfb8d8e826e30b1138a56355b88e9ba8 ↗
- https://git.kernel.org/stable/c/c16ac4e173a05011437a2d868f70cc415339065a ↗
- https://git.kernel.org/stable/c/1bf8761eb59e94bf7b8c17b2a1ee48f14378b172 ↗
- https://git.kernel.org/stable/c/a47ae40339c1048f519df33ff8840731720f57cb ↗
- https://git.kernel.org/stable/c/c8c607a77aab783f2e38cc2e0f24aa6c8f6d200b ↗
- https://git.kernel.org/stable/c/cc797d4821c754c701d9714b58bea947e31dbbe0 ↗