Description
In the Linux kernel, the following vulnerability has been resolved: efi/capsule-loader: fix incorrect sizeof in phys array reallocation The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation. The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys(). On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses. This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader: fix incorrect allocation size") which fixed the same issue at the initial allocation site.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f24c4d478013d82bd1b943df566fff3561d52864 to < 22022cd8851703a58f67615a17bc7e9e8682785baffectedf24c4d478013d82bd1b943df566fff3561d52864 to < 67adde6bfdfd563a54b045d59aeb9a2d90c80697affectedf24c4d478013d82bd1b943df566fff3561d52864 to < 608e1f7bc9d171ab26c1fba288c97fc76363c27daffectedf24c4d478013d82bd1b943df566fff3561d52864 to < 8be69e9245f805566bac68ffc8574b64735fd996affectedf24c4d478013d82bd1b943df566fff3561d52864 to < 5e185330d902b12fe8e6eb4b8514b5d736d8d66daffectedf24c4d478013d82bd1b943df566fff3561d52864 to < e0e6b14995fd6fa2c0df8c712d76ab32f0694c31affectedf24c4d478013d82bd1b943df566fff3561d52864 to < ab3f7098a3a27175b91cfc947950f5c26855801baffectedf24c4d478013d82bd1b943df566fff3561d52864 to < 48a428215782321b56956974f23593e40ce84b7aaffected95a362c9a6892085f714eb6e31eea6a0e3aa93bfaffected4.14.13 to < 4.15affected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/22022cd8851703a58f67615a17bc7e9e8682785b ↗
- https://git.kernel.org/stable/c/67adde6bfdfd563a54b045d59aeb9a2d90c80697 ↗
- https://git.kernel.org/stable/c/608e1f7bc9d171ab26c1fba288c97fc76363c27d ↗
- https://git.kernel.org/stable/c/8be69e9245f805566bac68ffc8574b64735fd996 ↗
- https://git.kernel.org/stable/c/5e185330d902b12fe8e6eb4b8514b5d736d8d66d ↗
- https://git.kernel.org/stable/c/e0e6b14995fd6fa2c0df8c712d76ab32f0694c31 ↗
- https://git.kernel.org/stable/c/ab3f7098a3a27175b91cfc947950f5c26855801b ↗
- https://git.kernel.org/stable/c/48a428215782321b56956974f23593e40ce84b7a ↗