Description
In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: bound TLV walk in mt7996_mcu_get_chip_config The response TLV loop advanced by tlv->len without a minimum, so a theoretical firmware response containing a zero-length TLV could spin forever, hanging the CPU during device probe. The u32 payload was also read without bounds checking. Reject a short fixed field, stop on a TLV whose length underruns the header or overruns the skb.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5d33053be609abfcfa9f5ca75d5554f2109aa40b to < 3106f62809d45c1e6aadfad1f4d7c3f74cd53a96affected5d33053be609abfcfa9f5ca75d5554f2109aa40b to < 39aa6b853b6d69dd1fee3507efdb3c277b7c53e6affected5d33053be609abfcfa9f5ca75d5554f2109aa40b to < d0bb2189ade617e624f3c8f444ebb05f59bb2524affected5d33053be609abfcfa9f5ca75d5554f2109aa40b to < 93eaddfdd35aa6bfe570c087db4e97fb9d8a791aaffected5d33053be609abfcfa9f5ca75d5554f2109aa40b to < 44af52467e72094351a362bf69effd52f1d9c186affected
Linux Linux
Default version status: affected
6.3affected0 to < 6.3unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3106f62809d45c1e6aadfad1f4d7c3f74cd53a96 ↗
- https://git.kernel.org/stable/c/39aa6b853b6d69dd1fee3507efdb3c277b7c53e6 ↗
- https://git.kernel.org/stable/c/d0bb2189ade617e624f3c8f444ebb05f59bb2524 ↗
- https://git.kernel.org/stable/c/93eaddfdd35aa6bfe570c087db4e97fb9d8a791a ↗
- https://git.kernel.org/stable/c/44af52467e72094351a362bf69effd52f1d9c186 ↗