Description
In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix out-of-bounds read in ims_pcu_irq() debug logging The debug logging in ims_pcu_irq() unconditionally prints data from pcu->urb_in_buf. However, if the interrupt fired for pcu->urb_ctrl, the actual data resides in pcu->urb_ctrl_buf. If urb->actual_length for the control URB exceeds pcu->max_in_size, this leads to an out-of-bounds read. Fix this by printing from the correct buffer associated with the URB.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
628329d52474323938a03826941e166bc7c8eff4 to < 4d2553e9a76a11500ec670cbe16b7fd3da4832deaffected628329d52474323938a03826941e166bc7c8eff4 to < b746e853721dee91e4234c033d1b90f4605705bbaffected628329d52474323938a03826941e166bc7c8eff4 to < e6153407d7edabc6ff98f0fda415d556c0bcb57aaffected628329d52474323938a03826941e166bc7c8eff4 to < 3fd7c0ace245334f2a0bd29fdcb680ad56e9b275affected628329d52474323938a03826941e166bc7c8eff4 to < 20fbf3ca0259d00664d1ede88837e1f11b49a88eaffected628329d52474323938a03826941e166bc7c8eff4 to < 9c964fc9507aeab74376ba9f892cf84ad6950dfeaffected628329d52474323938a03826941e166bc7c8eff4 to < f97bfc1a0766802a99167b3dc62d1ee7dca929feaffected628329d52474323938a03826941e166bc7c8eff4 to < 403b0a6970b1084bb27907c0f8225801fdd0fe1daffected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/4d2553e9a76a11500ec670cbe16b7fd3da4832de ↗
- https://git.kernel.org/stable/c/b746e853721dee91e4234c033d1b90f4605705bb ↗
- https://git.kernel.org/stable/c/e6153407d7edabc6ff98f0fda415d556c0bcb57a ↗
- https://git.kernel.org/stable/c/3fd7c0ace245334f2a0bd29fdcb680ad56e9b275 ↗
- https://git.kernel.org/stable/c/20fbf3ca0259d00664d1ede88837e1f11b49a88e ↗
- https://git.kernel.org/stable/c/9c964fc9507aeab74376ba9f892cf84ad6950dfe ↗
- https://git.kernel.org/stable/c/f97bfc1a0766802a99167b3dc62d1ee7dca929fe ↗
- https://git.kernel.org/stable/c/403b0a6970b1084bb27907c0f8225801fdd0fe1d ↗