Description
In the Linux kernel, the following vulnerability has been resolved: USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() build_i2c_fw_hdr() allocates a fixed-size buffer of (16*1024 - 512) + sizeof(struct ti_i2c_firmware_rec) bytes, then copies le16_to_cpu(img_header->Length) bytes into it without validating that Length fits within the available space after the firmware record header. img_header->Length is a __le16 from the firmware file and can be up to 65535. check_fw_sanity() validates the total firmware size but not img_header->Length specifically. Fix by rejecting images where img_header->Length exceeds the available destination space.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3e187152f44d76d7633a3855ffd0099e1588b82aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b7faf660eefa2047ebc2959ff76da2b6eae2e9e3affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2fd64bf0ad66ab5de0c73524591d879427ba5abaaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 4cb722747ed25971f35cc47ce5c0e79d7f717713affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 130d6567eb148040eed1b73e1414ad6c27d22bd5affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 294692d3296eee3391c348d7ea6401916d27806caffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 5a79b634ee58786ca627268daefa7744f2af2e14affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226aeaffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.259 to ≤ 5.10.*unaffected5.15.210 to ≤ 5.15.*unaffected6.1.176 to ≤ 6.1.*unaffected6.6.143 to ≤ 6.6.*unaffected6.12.94 to ≤ 6.12.*unaffected6.18.36 to ≤ 6.18.*unaffected7.0.13 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3e187152f44d76d7633a3855ffd0099e1588b82a ↗
- https://git.kernel.org/stable/c/b7faf660eefa2047ebc2959ff76da2b6eae2e9e3 ↗
- https://git.kernel.org/stable/c/2fd64bf0ad66ab5de0c73524591d879427ba5aba ↗
- https://git.kernel.org/stable/c/4cb722747ed25971f35cc47ce5c0e79d7f717713 ↗
- https://git.kernel.org/stable/c/130d6567eb148040eed1b73e1414ad6c27d22bd5 ↗
- https://git.kernel.org/stable/c/294692d3296eee3391c348d7ea6401916d27806c ↗
- https://git.kernel.org/stable/c/5a79b634ee58786ca627268daefa7744f2af2e14 ↗
- https://git.kernel.org/stable/c/0fd2b00b2d3d05e3eaa13342b3dfb0fa85c226ae ↗