Description
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating [Why&How] The GPIO pin table parsers in get_gpio_i2c_info() and bios_parser_get_gpio_pin_info() derive an element count from the VBIOS table_header.structuresize field, then iterate over gpio_pin[] entries. However, GET_IMAGE() only validates that the table header itself fits within the BIOS image. If the VBIOS reports a structuresize larger than the actual mapped data, the loop reads past the end of the BIOS image, causing an out-of-bounds read. Fix this by calling bios_get_image() to validate that the full claimed structuresize is accessible within the BIOS image before entering the loop in both functions. (cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ae79c310b1a6f97429a5784b65f125d9cc9c95b1 to < 9900f6954be779011e7c2cd42addd87baf028bc5affectedae79c310b1a6f97429a5784b65f125d9cc9c95b1 to < fb30a3890d62fd50a95aef684faf64a307592e42affectedae79c310b1a6f97429a5784b65f125d9cc9c95b1 to < 67461e0c15335894cc5d3b84cda823bf8cbdc886affectedae79c310b1a6f97429a5784b65f125d9cc9c95b1 to < 7ca695b3122297b06a3ed605bbe1cd32c85d9f5aaffectedae79c310b1a6f97429a5784b65f125d9cc9c95b1 to < f2a4827e980ba07de4391fa84d9c39a12726bdd7affectedae79c310b1a6f97429a5784b65f125d9cc9c95b1 to < 86d2b20644b11d21fe52c596e6e922b4590a3e3faffected
Linux Linux
Default version status: affected
4.15affected0 to < 4.15unaffected6.1.175 to ≤ 6.1.*unaffected6.6.142 to ≤ 6.6.*unaffected6.12.92 to ≤ 6.12.*unaffected6.18.34 to ≤ 6.18.*unaffected7.0.11 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/9900f6954be779011e7c2cd42addd87baf028bc5 ↗
- https://git.kernel.org/stable/c/fb30a3890d62fd50a95aef684faf64a307592e42 ↗
- https://git.kernel.org/stable/c/67461e0c15335894cc5d3b84cda823bf8cbdc886 ↗
- https://git.kernel.org/stable/c/7ca695b3122297b06a3ed605bbe1cd32c85d9f5a ↗
- https://git.kernel.org/stable/c/f2a4827e980ba07de4391fa84d9c39a12726bdd7 ↗
- https://git.kernel.org/stable/c/86d2b20644b11d21fe52c596e6e922b4590a3e3f ↗