Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: fix pointer truncation in kfifo on 64-bit ca8210_test_int_driver_write() and ca8210_test_int_user_read() exchange a kmalloc'd buffer pointer through a struct kfifo, but pass a literal '4' as the byte count to kfifo_in()/kfifo_out(). This is correct on 32-bit (pointer = 4 bytes), but on 64-bit only the low 4 bytes of the 8-byte pointer are written into the FIFO. The reader then reads back 4 bytes into an 8-byte local pointer variable, leaving the upper 4 bytes uninitialized stack data. The first dereference of the reconstructed pointer (fifo_buffer[1]) accesses an arbitrary kernel address and generally results in an oops. Use sizeof(fifo_buffer) so the byte count matches pointer width on every architecture. The driver has no architecture restriction in Kconfig, so any 64-bit build with CONFIG_IEEE802154_CA8210_DEBUGFS=y is exposed. Issue has been latent since the driver was added in 2017 because it is most commonly deployed on 32-bit MCUs. Found via a custom Coccinelle semantic patch hunting for short-byte kfifo I/O on byte-mode kfifos used to shuttle pointers.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ded845a781a578dfb0b5b2c138e5a067aa3b1242 to < 2c1664ccfae653979b38788211240b5a1ee317edaffectedded845a781a578dfb0b5b2c138e5a067aa3b1242 to < 093aacb0c56d5c693e3169a0224062e77c3fd0c0affectedded845a781a578dfb0b5b2c138e5a067aa3b1242 to < 87dab14a4f68895d6f4d798e6ee3556cd64e8c72affectedded845a781a578dfb0b5b2c138e5a067aa3b1242 to < 1fe2643d0b24ca3cdd61a31a45c2d3233dc6cbfeaffectedded845a781a578dfb0b5b2c138e5a067aa3b1242 to < 65dc342274a01616f5c17105f7360a3b4bfd7a3daffectedded845a781a578dfb0b5b2c138e5a067aa3b1242 to < 2059c28bd725beded01277cdf1f67be33e714323affectedded845a781a578dfb0b5b2c138e5a067aa3b1242 to < d8ce67fa6a5e6929f5414e933ff9665176c2bce6affectedded845a781a578dfb0b5b2c138e5a067aa3b1242 to < 6d7f7bcf225b2d566176bf6229dbd1252940cb3caffected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2c1664ccfae653979b38788211240b5a1ee317ed ↗
- https://git.kernel.org/stable/c/093aacb0c56d5c693e3169a0224062e77c3fd0c0 ↗
- https://git.kernel.org/stable/c/87dab14a4f68895d6f4d798e6ee3556cd64e8c72 ↗
- https://git.kernel.org/stable/c/1fe2643d0b24ca3cdd61a31a45c2d3233dc6cbfe ↗
- https://git.kernel.org/stable/c/65dc342274a01616f5c17105f7360a3b4bfd7a3d ↗
- https://git.kernel.org/stable/c/2059c28bd725beded01277cdf1f67be33e714323 ↗
- https://git.kernel.org/stable/c/d8ce67fa6a5e6929f5414e933ff9665176c2bce6 ↗
- https://git.kernel.org/stable/c/6d7f7bcf225b2d566176bf6229dbd1252940cb3c ↗