Description
In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each EC FIFO event carries an 8-bit sensor number (in->sensor_num). cros_ec_sensorhub_ring_handler() validates the FIFO event count, the per-read count and the ring bound, but not the sensor number, which cros_ec_sensor_ring_process_event() then uses unchecked to index sensorhub->batch_state[] - allocated with only sensorhub->sensor_num entries. A sensor number of sensor_num or larger is an out-of-bounds read and write of batch_state[]. Validate the sensor number in the ring handler, where each event is read from the EC, and drop a malformed event before it is used.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
145d59baff5944b71551ac518d7fd7d377a9c820 to < 3a76b87e1d065183e2e7ae5b800cb1f6e84f543daffected145d59baff5944b71551ac518d7fd7d377a9c820 to < 2b602ecf6193ecb9720c78b6728d7e09370b1ff1affected145d59baff5944b71551ac518d7fd7d377a9c820 to < 324880f94ba3c6269a607e04f78a4dd4a66b3f53affected145d59baff5944b71551ac518d7fd7d377a9c820 to < d1b4add68dabfdd6481a4fa198bf3b473d2634d7affected145d59baff5944b71551ac518d7fd7d377a9c820 to < 3d2636dce0a8fe9eecad29010699847be425dc80affected145d59baff5944b71551ac518d7fd7d377a9c820 to < 5eaf7faa99578ae090030d1e2e6ea3b37a615496affected145d59baff5944b71551ac518d7fd7d377a9c820 to < 4d9bf63ed74f859c6698bc01d8fb216ef9253867affected145d59baff5944b71551ac518d7fd7d377a9c820 to < 833740a2333c2e4db4e02e3d0ffba04e8718a5f3affected
Linux Linux
Default version status: affected
5.7affected0 to < 5.7unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3a76b87e1d065183e2e7ae5b800cb1f6e84f543d ↗
- https://git.kernel.org/stable/c/2b602ecf6193ecb9720c78b6728d7e09370b1ff1 ↗
- https://git.kernel.org/stable/c/324880f94ba3c6269a607e04f78a4dd4a66b3f53 ↗
- https://git.kernel.org/stable/c/d1b4add68dabfdd6481a4fa198bf3b473d2634d7 ↗
- https://git.kernel.org/stable/c/3d2636dce0a8fe9eecad29010699847be425dc80 ↗
- https://git.kernel.org/stable/c/5eaf7faa99578ae090030d1e2e6ea3b37a615496 ↗
- https://git.kernel.org/stable/c/4d9bf63ed74f859c6698bc01d8fb216ef9253867 ↗
- https://git.kernel.org/stable/c/833740a2333c2e4db4e02e3d0ffba04e8718a5f3 ↗