Description
In the Linux kernel, the following vulnerability has been resolved: iio: pressure: bmp280: fix stack leak in bmp580 trigger handler bmp580_trigger_handler() declares its scan buffer on the stack without an initializer and then memcpy()s 3 bytes of 24-bit sensor data into each 4-byte __le32 field. The high byte of comp_temp and comp_press is left uninitialized, and the channel storagebits is 32, so two bytes of stack are pushed to userspace per scan. This is a regression from when the buffer lived in the private data, the move to a stack-local struct dropped the implicit zeroing. bme280_trigger_handler() was fixed up to handle this bug, but this driver was not fixed because there was no padding hole, but rather a short-fill issue. Fix this all by just zero-initializing the structure on the stack.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
872c8014e05ed47b8a7c0f5ba4311279a637150b to < a58400f58f82f3d8de9c067aa7cda690228c1eccaffected872c8014e05ed47b8a7c0f5ba4311279a637150b to < 58dfb6fe9dc80270cf7cc014837af4cbf928e3aaaffected872c8014e05ed47b8a7c0f5ba4311279a637150b to < 387c86b582e0782ab332e7bfcd4e6e3f93922961affected
Linux Linux
Default version status: affected
6.16affected0 to < 6.16unaffected6.18.35 to ≤ 6.18.*unaffected7.0.12 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected