Description
In the Linux kernel, the following vulnerability has been resolved: mtd: afs: validate v2 image info bounds The AFS v2 parser uses footer[8] to locate the image information block inside the current erase block, then uses the image information region_count to walk entries from a fixed local array. The footer offset and region count come from flash contents and are not checked against the erase block or the local image-info array before use. Reject v2 entries whose image information offset would underflow the erase block calculation, and reject region counts that cannot fit in the local image-info array before walking region entries.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b7cf5e2830bbb128699d7635ce8404b7f605bc95 to < 1bec05a68414cf8d0cab6cb42445b8603f32ffc4affectedb7cf5e2830bbb128699d7635ce8404b7f605bc95 to < 3ad8ff12fd44b08af9212ac4883a7e29d2ab7348affectedb7cf5e2830bbb128699d7635ce8404b7f605bc95 to < 875daa3c750814ff2e2dc050239c390048f0bcd0affectedb7cf5e2830bbb128699d7635ce8404b7f605bc95 to < da740539e8f370767317e24615349b9342a6e773affectedb7cf5e2830bbb128699d7635ce8404b7f605bc95 to < 1edea8900ca3e405c1421d8b5c29f97107874f72affectedb7cf5e2830bbb128699d7635ce8404b7f605bc95 to < 18916f475057cbd2fb8ea6ae86e6b85884ad1d53affectedb7cf5e2830bbb128699d7635ce8404b7f605bc95 to < d14e6298139f58a87a87d7022e26a7f37f0ddce7affectedb7cf5e2830bbb128699d7635ce8404b7f605bc95 to < e9290031f736e99ad17c25c00311c92c266843b7affected
Linux Linux
Default version status: affected
5.2affected0 to < 5.2unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1bec05a68414cf8d0cab6cb42445b8603f32ffc4 ↗
- https://git.kernel.org/stable/c/3ad8ff12fd44b08af9212ac4883a7e29d2ab7348 ↗
- https://git.kernel.org/stable/c/875daa3c750814ff2e2dc050239c390048f0bcd0 ↗
- https://git.kernel.org/stable/c/da740539e8f370767317e24615349b9342a6e773 ↗
- https://git.kernel.org/stable/c/1edea8900ca3e405c1421d8b5c29f97107874f72 ↗
- https://git.kernel.org/stable/c/18916f475057cbd2fb8ea6ae86e6b85884ad1d53 ↗
- https://git.kernel.org/stable/c/d14e6298139f58a87a87d7022e26a7f37f0ddce7 ↗
- https://git.kernel.org/stable/c/e9290031f736e99ad17c25c00311c92c266843b7 ↗