Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pt5161l) Fix bugs in pt5161l_read_block_data() Fix two bugs in pt5161l_read_block_data(): 1. Buffer overrun: The local buffer rbuf is declared as u8 rbuf[24], but i2c_smbus_read_block_data() can return up to I2C_SMBUS_BLOCK_MAX (32) bytes. The i2c-core copies the data into the caller's buffer before the return value can be checked, so the post-read length validation does not prevent a stack overrun if a device returns more than 24 bytes. Resize the buffer to I2C_SMBUS_BLOCK_MAX. 2. Unexpected positive return on length mismatch: When all three retries are exhausted because the device returns data with an unexpected length, i2c_smbus_read_block_data() returns a positive byte count. The function returns this directly, and callers treat any non-negative return as success, processing stale or incomplete buffer contents. Return -EIO when retries are exhausted with a positive return value, preserving the negative error code on I2C failure.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 to < 7eccabff1c9ec15e4b6fe186d5c147b13a9cdb4eaffected1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 to < 95d48e37a1304d6148406c799479c0fb505aefa7affected1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 to < a11aa9c5fd9dfe62be7cfec1f2a7546afb77254caffected1b2ca93cd0592b1fcbc6f8b64e02552bc15f4bb4 to < 24c73e93d6a756e1b8626bb259d2e07c5b89b370affected
Linux Linux
Default version status: affected
6.9affected0 to < 6.9unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected