Description
In the Linux kernel, the following vulnerability has been resolved: drm/ioc32: stop speculation on the drm_compat_ioctl path The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
505b5240329b922f21f91d5b5d1e535c805eca6d to < 46a60ee8956ef1975f00455f614761c7ecedc09daffected505b5240329b922f21f91d5b5d1e535c805eca6d to < 5bb398991f378ef74d90b14a6ea8b61ff96cc03aaffected505b5240329b922f21f91d5b5d1e535c805eca6d to < d59c5d8539662d95887b4564f3f72ad38076a2d5affected505b5240329b922f21f91d5b5d1e535c805eca6d to < 489f2ef2b908898d01df697dc4fe1476674be640affected505b5240329b922f21f91d5b5d1e535c805eca6d to < 4a41c2b18fc05d30b718d2602cac339eae710b34affected505b5240329b922f21f91d5b5d1e535c805eca6d to < f0e441be08a2eab10b2d06fccfa267ee599dd6b3affected505b5240329b922f21f91d5b5d1e535c805eca6d to < 27ef84bba9b9d7b03418c60fbc6069ea0e87b13caffected505b5240329b922f21f91d5b5d1e535c805eca6d to < f8995c2df519f382525ca4bc90553ad2ec611067affectedabc60edcfc87771ff244763d4d19c67766f5dd0faffecteda2a840d6dcae960c2dfdf3fcb1b759e1b7d90663affected00279b505289f7529d9be2e78915d0483ffbd314affectedd04e6ea0cec9e7d6cba806508f657d2d0dc6cacfaffected7f3ebea19795eb38438cd3709fabf2afd53cf447affected3.16.63 to < 3.17affected4.4.170 to < 4.5affected4.9.148 to < 4.10affected4.14.91 to < 4.15affected4.19.13 to < 4.20affected
Linux Linux
Default version status: affected
4.20affected0 to < 4.20unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/46a60ee8956ef1975f00455f614761c7ecedc09d ↗
- https://git.kernel.org/stable/c/5bb398991f378ef74d90b14a6ea8b61ff96cc03a ↗
- https://git.kernel.org/stable/c/d59c5d8539662d95887b4564f3f72ad38076a2d5 ↗
- https://git.kernel.org/stable/c/489f2ef2b908898d01df697dc4fe1476674be640 ↗
- https://git.kernel.org/stable/c/4a41c2b18fc05d30b718d2602cac339eae710b34 ↗
- https://git.kernel.org/stable/c/f0e441be08a2eab10b2d06fccfa267ee599dd6b3 ↗
- https://git.kernel.org/stable/c/27ef84bba9b9d7b03418c60fbc6069ea0e87b13c ↗
- https://git.kernel.org/stable/c/f8995c2df519f382525ca4bc90553ad2ec611067 ↗