Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) reject implausible blackbox record_count adm1266_nvmem_read_blackbox() loops over a record_count that comes straight from byte 3 of the BLACKBOX_INFO response. The destination buffer is data->dev_mem, sized for the nvmem cell's declared 2048 bytes (ADM1266_BLACKBOX_MAX_RECORDS * ADM1266_BLACKBOX_SIZE = 32 * 64). A device that reports a record_count greater than 32 -- whether due to firmware bugs, bus corruption, or a non-responsive slave returning 0xff -- would walk read_buff past the end of the dev_mem allocation on the trailing iterations. Cap record_count at ADM1266_BLACKBOX_MAX_RECORDS (introduced here) before entering the loop and return -EIO on any larger value, so a malformed BLACKBOX_INFO response cannot drive the loop out of bounds.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
15609d1893020436e1e8ccfd9ded774a96dd17a2 to < adcb163ad7cacca317872fc62bd8885e842e45e3affected15609d1893020436e1e8ccfd9ded774a96dd17a2 to < c2c56092710fe8a893b67b5a3d7e62808d02d84daffected15609d1893020436e1e8ccfd9ded774a96dd17a2 to < 5469e1e7c411acc15fdd8262c99c3ebd9defd594affected15609d1893020436e1e8ccfd9ded774a96dd17a2 to < f85c81e93dbd6915970bd5f3bffcf62633c4c54caffected15609d1893020436e1e8ccfd9ded774a96dd17a2 to < 0e791cd0140fb136083565aadfbe0f705aa260d0affected15609d1893020436e1e8ccfd9ded774a96dd17a2 to < 75c862adf3d3caab4f49bb3530723c215376e37caffected15609d1893020436e1e8ccfd9ded774a96dd17a2 to < 231db52a5b64d0a9769e298dadc148e1f79b26a6affected15609d1893020436e1e8ccfd9ded774a96dd17a2 to < 4afca954622d672ea65ed961bed01cf91caa034eaffected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.142 to ≤ 6.6.*unaffected6.12.92 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/adcb163ad7cacca317872fc62bd8885e842e45e3 ↗
- https://git.kernel.org/stable/c/c2c56092710fe8a893b67b5a3d7e62808d02d84d ↗
- https://git.kernel.org/stable/c/5469e1e7c411acc15fdd8262c99c3ebd9defd594 ↗
- https://git.kernel.org/stable/c/f85c81e93dbd6915970bd5f3bffcf62633c4c54c ↗
- https://git.kernel.org/stable/c/0e791cd0140fb136083565aadfbe0f705aa260d0 ↗
- https://git.kernel.org/stable/c/75c862adf3d3caab4f49bb3530723c215376e37c ↗
- https://git.kernel.org/stable/c/231db52a5b64d0a9769e298dadc148e1f79b26a6 ↗
- https://git.kernel.org/stable/c/4afca954622d672ea65ed961bed01cf91caa034e ↗