Description
In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: fix heap overflow from oversized firmware HAL response The firmware response dispatcher copies all synchronous HAL responses into the 4096-byte hal_buf without validating the response length. A response exceeding WCN36XX_HAL_BUF_SIZE causes a heap buffer overflow with firmware-controlled content. Add a bounds check on the response length.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8e84c25821698bdef73c0329fb2022a4673b7adc to < dae9cadf0925f1cbfb71306d60490890df3870a6affected8e84c25821698bdef73c0329fb2022a4673b7adc to < cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92affected8e84c25821698bdef73c0329fb2022a4673b7adc to < 15545ee71301e82d26d9a31b407ed0019eb62a60affected8e84c25821698bdef73c0329fb2022a4673b7adc to < 1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18affected8e84c25821698bdef73c0329fb2022a4673b7adc to < 18813b90032bfaafb225906a4d2b51be4dfc02c3affected8e84c25821698bdef73c0329fb2022a4673b7adc to < 88a240d86d3d64521f9194abe185ac71cc74d0bdaffected
Linux Linux
Default version status: affected
3.13affected0 to < 3.13unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/dae9cadf0925f1cbfb71306d60490890df3870a6 ↗
- https://git.kernel.org/stable/c/cfc67aee0c83e7f5d43a1dad3e25c789e9cc1d92 ↗
- https://git.kernel.org/stable/c/15545ee71301e82d26d9a31b407ed0019eb62a60 ↗
- https://git.kernel.org/stable/c/1b5d8a248c3afa640bcc99fa95abcd1e36f3ee18 ↗
- https://git.kernel.org/stable/c/18813b90032bfaafb225906a4d2b51be4dfc02c3 ↗
- https://git.kernel.org/stable/c/88a240d86d3d64521f9194abe185ac71cc74d0bd ↗