Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: validate default EEPROM firmware size The default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy. Reject files shorter than MT7996_EEPROM_SIZE before parsing or copying the firmware.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
98686cd21624c75a043e96812beadddf4f6f48e5 to < b4bf67cc0871b13103c404b38e332b9d4403a0daaffected98686cd21624c75a043e96812beadddf4f6f48e5 to < 127a291f4c8069a4e71906938402cacfe24ee8cdaffected98686cd21624c75a043e96812beadddf4f6f48e5 to < 03b81f015dbb29807ce1ec6d45537d658abdac69affected98686cd21624c75a043e96812beadddf4f6f48e5 to < 7074ec3769820302f1ccf8794a40a6582153b820affected98686cd21624c75a043e96812beadddf4f6f48e5 to < 653c6e289b13cc6942f3e8f8e3c568e70fa42d1faffected
Linux Linux
Default version status: affected
6.2affected0 to < 6.2unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b4bf67cc0871b13103c404b38e332b9d4403a0da ↗
- https://git.kernel.org/stable/c/127a291f4c8069a4e71906938402cacfe24ee8cd ↗
- https://git.kernel.org/stable/c/03b81f015dbb29807ce1ec6d45537d658abdac69 ↗
- https://git.kernel.org/stable/c/7074ec3769820302f1ccf8794a40a6582153b820 ↗
- https://git.kernel.org/stable/c/653c6e289b13cc6942f3e8f8e3c568e70fa42d1f ↗