Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthor_fw_read_build_info() checks whether the metadata range fits in the firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation. The function also reads the "git_sha: " prefix without first checking that the metadata is long enough, and meta_size == 0 can underflow the NULL terminator index. Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2718d91816eeed03c09c8abe872e45f59078768c to < 5516f1acfd07564361cf306cc90a8e513df0f096affected2718d91816eeed03c09c8abe872e45f59078768c to < 6ae19dce3e8c13ae73590b3f4311abe9f96bbae8affected2718d91816eeed03c09c8abe872e45f59078768c to < 8321b093fa6c297b80586460ce6914d9655df170affected
Linux Linux
Default version status: affected
6.10affected0 to < 6.10unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected