Description
In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out. Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
5e5ac21f629de796ab5d598b59c5e468c6fe4f95 to < b8abbd5c2928fd839dab702244cc57b228ab43aaaffected5e5ac21f629de796ab5d598b59c5e468c6fe4f95 to < ca95b15a0760e7724e61addbdd61050be13b6406affected5e5ac21f629de796ab5d598b59c5e468c6fe4f95 to < 2aeb21fe557ef154f0cdf4f9745ebd8d5b31ca83affected
Linux Linux
Default version status: affected
6.15affected0 to < 6.15unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected