Description
In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory size before that copy. The event walker also uses a reversed loop condition and can inspect a short event record. Validate the complete notification length before copying it, iterate only while a full event header remains, and stop when a declared event payload extends beyond the copied notification data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 to < cbc24bce70dfd91c7b2f53b4fa896e9a4b6d6a6baffectedbf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 to < c7bc5e7677bcda7a446d63b989cfaa3fe91d6b76affectedbf3022a4eb119c6b4e3424d6b19d8bfdfbc9bb57 to < 11d5af151bcbe78f5a579e0faecd3be9cea0399aaffected
Linux Linux
Default version status: affected
6.18affected0 to < 6.18unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected