Description
In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
25e2c2a3eff55683bbe77b108db2a7e389246666 to < 16a2716910ecf7d31bf3c033ee7c506a0b00b2eeaffected25e2c2a3eff55683bbe77b108db2a7e389246666 to < 16bcea56f4205314ec2aa04a7ec74e5261d253c7affected25e2c2a3eff55683bbe77b108db2a7e389246666 to < 60baa179ed1333535f6e2da4133511db55278ee4affected
Linux Linux
Default version status: affected
6.14affected0 to < 6.14unaffected6.18.46 to ≤ 6.18.*unaffected7.1.10 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected