Description
In the Linux kernel, the following vulnerability has been resolved: Input: goodix - clamp the device-reported contact count goodix_ts_read_input_report() copies the number of touch points reported by the device into an on-stack buffer u8 point_data[2 + GOODIX_MAX_CONTACT_SIZE * GOODIX_MAX_CONTACTS]; which is sized for at most GOODIX_MAX_CONTACTS (10) contacts. The only runtime check bounds the per-interrupt count against ts->max_touch_num, but that value is taken verbatim from a 4-bit field of the device configuration block and is never clamped: ts->max_touch_num = ts->config[MAX_CONTACTS_LOC] & 0x0f; The nibble can be 0..15, so a malfunctioning, malicious or counterfeit controller (or an attacker tampering with the I2C bus) can advertise up to 15 contacts. goodix_ts_read_input_report() then accepts a touch_num of up to 15 and the second goodix_i2c_read() writes ts->contact_size * (touch_num - 1) bytes past the one-contact header into point_data - up to 30 bytes (45 with the 9-byte report format) beyond the 92-byte buffer: a stack out-of-bounds write. Clamp max_touch_num to GOODIX_MAX_CONTACTS, the number of contacts point_data[] is sized for, when reading it from the configuration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a7ac7c95d4682883d141c5d7a7544d2818f0a09f to < e825f352ef5271255cd08cc994b0dc25648a2f38affecteda7ac7c95d4682883d141c5d7a7544d2818f0a09f to < 4bfea9c3a0981c1c7fc5d1a1b27197b2de247902affecteda7ac7c95d4682883d141c5d7a7544d2818f0a09f to < 98b2caef249183b572c04451365246f919707845affecteda7ac7c95d4682883d141c5d7a7544d2818f0a09f to < 719d1a2c83a46be6bf81af905e4f6adb3d32dc28affecteda7ac7c95d4682883d141c5d7a7544d2818f0a09f to < 46addbd13dbf4aacb71cfbca964a5e552d0f45aeaffecteda7ac7c95d4682883d141c5d7a7544d2818f0a09f to < 3b32303460155603d25444274856013d211d5e1faffecteda7ac7c95d4682883d141c5d7a7544d2818f0a09f to < 2a67668690129953e898923260a2dd1c7c196495affecteda7ac7c95d4682883d141c5d7a7544d2818f0a09f to < 5ed62a96e06be4e94b8296b7932afee550a70e04affected
Linux Linux
Default version status: affected
4.1affected0 to < 4.1unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.96 to ≤ 6.12.*unaffected6.18.39 to ≤ 6.18.*unaffected7.1.4 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/e825f352ef5271255cd08cc994b0dc25648a2f38 ↗
- https://git.kernel.org/stable/c/4bfea9c3a0981c1c7fc5d1a1b27197b2de247902 ↗
- https://git.kernel.org/stable/c/98b2caef249183b572c04451365246f919707845 ↗
- https://git.kernel.org/stable/c/719d1a2c83a46be6bf81af905e4f6adb3d32dc28 ↗
- https://git.kernel.org/stable/c/46addbd13dbf4aacb71cfbca964a5e552d0f45ae ↗
- https://git.kernel.org/stable/c/3b32303460155603d25444274856013d211d5e1f ↗
- https://git.kernel.org/stable/c/2a67668690129953e898923260a2dd1c7c196495 ↗
- https://git.kernel.org/stable/c/5ed62a96e06be4e94b8296b7932afee550a70e04 ↗