Description
In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: bound memcpy length in cmd callback to prevent OOB read When the firmware sends a command response with a length mismatch, carl9170_cmd_callback() logs the mismatch and calls carl9170_restart() but then falls through to memcpy(ar->readbuf, buffer + 4, len - 4). Since len comes from the firmware and can exceed ar->readlen, this copies more data than the readbuf was allocated for. Bound the memcpy to min(len - 4, ar->readlen) so that the response is still completed -- avoiding repeated restarts from queued garbage -- while preventing an overread past the response buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a84fab3cbfdc427e7d366f1cc844f27b2084c26c to < 38e240996a6a78c94ab07d461fd66e361d55c3c4affecteda84fab3cbfdc427e7d366f1cc844f27b2084c26c to < 2d05c321d27624c413c950278d2dc8e0f44a8950affecteda84fab3cbfdc427e7d366f1cc844f27b2084c26c to < 525036b20ef01d814a7fcd0567d123992e4479faaffecteda84fab3cbfdc427e7d366f1cc844f27b2084c26c to < f74e34e66379e487a09009a4f2d42470051672bdaffecteda84fab3cbfdc427e7d366f1cc844f27b2084c26c to < 500c36649f270de05a56591fcc1aaaa36687958eaffecteda84fab3cbfdc427e7d366f1cc844f27b2084c26c to < 9aee949c68dc6dccbc54333537b109c53fe2079faffecteda84fab3cbfdc427e7d366f1cc844f27b2084c26c to < cb7a38810cf25738176dac32dec7a146b3f959cfaffecteda84fab3cbfdc427e7d366f1cc844f27b2084c26c to < 4cde55b2feff9504d1f993ab80e84e7ccb62791caffected
Linux Linux
Default version status: affected
2.6.37affected0 to < 2.6.37unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/38e240996a6a78c94ab07d461fd66e361d55c3c4 ↗
- https://git.kernel.org/stable/c/2d05c321d27624c413c950278d2dc8e0f44a8950 ↗
- https://git.kernel.org/stable/c/525036b20ef01d814a7fcd0567d123992e4479fa ↗
- https://git.kernel.org/stable/c/f74e34e66379e487a09009a4f2d42470051672bd ↗
- https://git.kernel.org/stable/c/500c36649f270de05a56591fcc1aaaa36687958e ↗
- https://git.kernel.org/stable/c/9aee949c68dc6dccbc54333537b109c53fe2079f ↗
- https://git.kernel.org/stable/c/cb7a38810cf25738176dac32dec7a146b3f959cf ↗
- https://git.kernel.org/stable/c/4cde55b2feff9504d1f993ab80e84e7ccb62791c ↗