Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix OOB read from firmware count in PRINT_REG_INFO indication The firmware-controlled rsp->count field is used as the loop bound for indexing into the flexible rsp->regs[] array without validation against the message length. A count exceeding the actual data causes out-of- bounds reads from the heap-allocated message buffer. Add a check that count fits within the received message.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
43efa3c0f241e04862be8e6a68ff765d36cde1ba to < 22b0b8572a64362531dd0ed499b75e16282aeb2baffected43efa3c0f241e04862be8e6a68ff765d36cde1ba to < 3cf92b44c4fb88a5e8de8733a4494c0956606bcaaffected43efa3c0f241e04862be8e6a68ff765d36cde1ba to < 0907c06dccae9e3c8d5a68eb9014beec73a36e79affected43efa3c0f241e04862be8e6a68ff765d36cde1ba to < 64228dfc4247aca178c01e5a37af7d8dcc7a6089affected43efa3c0f241e04862be8e6a68ff765d36cde1ba to < 23d210877968657bd07e1a517e0b516db20a1d80affected43efa3c0f241e04862be8e6a68ff765d36cde1ba to < f03782f7f41f2afee5076a1ef08ced5649218771affected43efa3c0f241e04862be8e6a68ff765d36cde1ba to < f987efff29a5fe45320ea5991c9d5cb98b676953affected43efa3c0f241e04862be8e6a68ff765d36cde1ba to < df2187acfca6c6cca372c5d35f42394d9c270b09affected
Linux Linux
Default version status: affected
4.11affected0 to < 4.11unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/22b0b8572a64362531dd0ed499b75e16282aeb2b ↗
- https://git.kernel.org/stable/c/3cf92b44c4fb88a5e8de8733a4494c0956606bca ↗
- https://git.kernel.org/stable/c/0907c06dccae9e3c8d5a68eb9014beec73a36e79 ↗
- https://git.kernel.org/stable/c/64228dfc4247aca178c01e5a37af7d8dcc7a6089 ↗
- https://git.kernel.org/stable/c/23d210877968657bd07e1a517e0b516db20a1d80 ↗
- https://git.kernel.org/stable/c/f03782f7f41f2afee5076a1ef08ced5649218771 ↗
- https://git.kernel.org/stable/c/f987efff29a5fe45320ea5991c9d5cb98b676953 ↗
- https://git.kernel.org/stable/c/df2187acfca6c6cca372c5d35f42394d9c270b09 ↗