Description
In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1x_debug_output() and host1x_debug_cont() used vsnprintf(), which returns the length the formatted string would have reached with an unbounded buffer. That return value was passed straight to o->fn as the number of bytes to emit. This could cause a read past end of the output buffer if a call to host1x_debug_* produced a string longer than 256 bytes. This only affected the debugfs files as the printk debug sink ignores the number of bytes. In practice, this is very unlikely to occur. Fix by switching to vscnprintf(), which returns the number of bytes actually written.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6236451d83a720072053855fa63d51934024a707 to < d7a560dc912756fd8b39b28b10818d931e863d2daffected6236451d83a720072053855fa63d51934024a707 to < 41517c46002afd717f0f2d0975c740dd610f87feaffected6236451d83a720072053855fa63d51934024a707 to < ebab3a25a0403bcbc0c40ef77d69d23270e45547affected6236451d83a720072053855fa63d51934024a707 to < 4f9f0afdbdf513a49065207ff6b7e1d15051175aaffected6236451d83a720072053855fa63d51934024a707 to < 819dd96a6571f2b12496b080e5187ba3fa897232affected6236451d83a720072053855fa63d51934024a707 to < 9ad7a6ccc7b839247663d57d3dbb4481dec492deaffected6236451d83a720072053855fa63d51934024a707 to < b00290d1dc23a5ef9a0d3103aad1fe2274e86569affected6236451d83a720072053855fa63d51934024a707 to < bc17ac285fb708f22a8fa2c0ed32eceb1d37e6d6affected
Linux Linux
Default version status: affected
3.10affected0 to < 3.10unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/d7a560dc912756fd8b39b28b10818d931e863d2d ↗
- https://git.kernel.org/stable/c/41517c46002afd717f0f2d0975c740dd610f87fe ↗
- https://git.kernel.org/stable/c/ebab3a25a0403bcbc0c40ef77d69d23270e45547 ↗
- https://git.kernel.org/stable/c/4f9f0afdbdf513a49065207ff6b7e1d15051175a ↗
- https://git.kernel.org/stable/c/819dd96a6571f2b12496b080e5187ba3fa897232 ↗
- https://git.kernel.org/stable/c/9ad7a6ccc7b839247663d57d3dbb4481dec492de ↗
- https://git.kernel.org/stable/c/b00290d1dc23a5ef9a0d3103aad1fe2274e86569 ↗
- https://git.kernel.org/stable/c/bc17ac285fb708f22a8fa2c0ed32eceb1d37e6d6 ↗