Description
In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: debugfs: Reserve space for a string terminator ufs_saved_err_write() copies user input into a zero-initialized stack buffer and passes it to kstrtoint(). A write that fills the entire buffer overwrites its only terminator. Reject an input whose length leaves no room for the trailing NUL.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
7340faae947400907e5e7581444712110d2811d5 to < b43890843e834300f967c69e74c7c2eb22cb1664affected7340faae947400907e5e7581444712110d2811d5 to < 587be18e0935632ebd367b0f89e37aa5762e400faffected7340faae947400907e5e7581444712110d2811d5 to < d223989e1a1edad217b673486b093bd157fb6c9aaffected7340faae947400907e5e7581444712110d2811d5 to < cc92af8cc0e4dacd4375d34475141b0f1a70c09eaffected7340faae947400907e5e7581444712110d2811d5 to < 2b3fb5693c25c21741f357a8c9d0e1f19b7e368faffected7340faae947400907e5e7581444712110d2811d5 to < abd26e6b53c4169122d61fdd4cabe09bdd916aacaffected
Linux Linux
Default version status: affected
5.16affected0 to < 5.16unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b43890843e834300f967c69e74c7c2eb22cb1664 ↗
- https://git.kernel.org/stable/c/587be18e0935632ebd367b0f89e37aa5762e400f ↗
- https://git.kernel.org/stable/c/d223989e1a1edad217b673486b093bd157fb6c9a ↗
- https://git.kernel.org/stable/c/cc92af8cc0e4dacd4375d34475141b0f1a70c09e ↗
- https://git.kernel.org/stable/c/2b3fb5693c25c21741f357a8c9d0e1f19b7e368f ↗
- https://git.kernel.org/stable/c/abd26e6b53c4169122d61fdd4cabe09bdd916aac ↗