Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.size = hdr.data.end - hdr.data.start; If a crafted firmware sets data.size larger than the allocated memory, this could cause a heap buffer overflow in panthor_fw_init_section_mem() memcpy(section->mem->kmap, section->data.buf, section->data.size); Additionally, if the section->data.size exceeds the BO size, could this memset underflow the size calculation, leading to a massive out-of-bounds zeroing of kernel memory? memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size); Reject section entries whose initial data is larger than the section size.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2718d91816eeed03c09c8abe872e45f59078768c to < 0e57165ca025a67d8dfd17efd2765fdd4925fdabaffected2718d91816eeed03c09c8abe872e45f59078768c to < 2a761b9be5863e1d26a584f0c2d1e114a684ed9aaffected2718d91816eeed03c09c8abe872e45f59078768c to < 7f4674d986c15c74327cb6ac6e2e2afecf061e04affected2718d91816eeed03c09c8abe872e45f59078768c to < a3caaa06809248b996254be5b47e10804a3494e2affected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected