Description
In the Linux kernel, the following vulnerability has been resolved: ACPI: pfr_update: fix stack buffer overflow in query_capability() query_capability() copies four ACPI buffer objects returned by the firmware _DSM into fixed-size u8[16] fields in struct pfru_update_cap_info using memcpy with the firmware-supplied length: memcpy(&cap_hdr->code_type, elements[CAP_CODE_TYPE_IDX].buffer.pointer, elements[CAP_CODE_TYPE_IDX].buffer.length); The same pattern repeats for drv_type, platform_id, and oem_id. If the firmware returns buffer.length > 16 for any of these fields, memcpy writes past the destination array. struct pfru_update_cap_info is stack-allocated in pfru_ioctl(). Confirmed with KASAN on 7.2-rc6: three stack-out-of-bounds reports are generated when a DSM returns 64-byte buffers, with writes reaching 44 bytes past the end of cap_hdr's [64, 156) frame window into adjacent stack redzones. Introduce a helper pointer to out_obj->package.elements and use it to validate each buffer length against its destination field size before copying, returning -EINVAL if the firmware supplies an oversized buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0db89fa243e5edc5de38c88b369e4c3755c5fb74 to < d3af83e327565a9444cebc0db714cb837e493046affected0db89fa243e5edc5de38c88b369e4c3755c5fb74 to < c5a31b4e7e37c92550be9a2edf51ca853a4d251aaffected0db89fa243e5edc5de38c88b369e4c3755c5fb74 to < a2151624b55029dad0ca7efd17fb83a0461c8843affected0db89fa243e5edc5de38c88b369e4c3755c5fb74 to < 6d4ed2fd022bc862b156e53aae163b61259e1caaaffected0db89fa243e5edc5de38c88b369e4c3755c5fb74 to < 15d2b7f38f95d28652170344f39ee492c55e567caffected0db89fa243e5edc5de38c88b369e4c3755c5fb74 to < ced45be0073a8a31b30b4a7f68cd3a15734515deaffected
Linux Linux
Default version status: affected
5.17affected0 to < 5.17unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d3af83e327565a9444cebc0db714cb837e493046 ↗
- https://git.kernel.org/stable/c/c5a31b4e7e37c92550be9a2edf51ca853a4d251a ↗
- https://git.kernel.org/stable/c/a2151624b55029dad0ca7efd17fb83a0461c8843 ↗
- https://git.kernel.org/stable/c/6d4ed2fd022bc862b156e53aae163b61259e1caa ↗
- https://git.kernel.org/stable/c/15d2b7f38f95d28652170344f39ee492c55e567c ↗
- https://git.kernel.org/stable/c/ced45be0073a8a31b30b4a7f68cd3a15734515de ↗