Description
In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate TV mode names before creating enum property The GUD protocol returns TV mode names as fixed-size GUD_CONNECTOR_TV_MODE_NAME_LEN entries and requires each name to be NUL-terminated. gud_connector_add_tv_mode() currently passes each fixed-size entry directly to drm_mode_create_tv_properties_legacy(), which eventually reaches drm_property_add_enum() and strlen(). If a device returns an entry without a terminating NUL byte, strlen() reads past the end of the slot and can run beyond the allocated buffer, triggering an out-of-bounds read. Validate that each returned TV mode name contains a NUL terminator within its fixed-size slot before passing it to the DRM property code. If a malformed entry is found, reject the device response with -EIO. This fixes the out-of-bounds read without changing the handling of valid devices, and avoids silently truncating malformed protocol data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
40e1a70b4aedf2859a1829991b48ef0ebe650bf2 to < 676f1fb3632bbc9ce83be7938e93fe6bfc9510fdaffected40e1a70b4aedf2859a1829991b48ef0ebe650bf2 to < 06fcaf21c18ac88f57fee3803554f48c6026b95faffected40e1a70b4aedf2859a1829991b48ef0ebe650bf2 to < 082e378886547b5b1c4075ed307f7c68547868dcaffected40e1a70b4aedf2859a1829991b48ef0ebe650bf2 to < 70cffc31a380b3eae45027101647aa94c242aa0eaffected40e1a70b4aedf2859a1829991b48ef0ebe650bf2 to < 72a95df6bbc7d20c7af1e39d86b3e910cccd01adaffected40e1a70b4aedf2859a1829991b48ef0ebe650bf2 to < eab46d9629807db1b5647d17227e16110a18227faffected40e1a70b4aedf2859a1829991b48ef0ebe650bf2 to < da1ea35fea67ad841f4ada28dd61b41be65e5437affected
Linux Linux
Default version status: affected
5.13affected0 to < 5.13unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/676f1fb3632bbc9ce83be7938e93fe6bfc9510fd ↗
- https://git.kernel.org/stable/c/06fcaf21c18ac88f57fee3803554f48c6026b95f ↗
- https://git.kernel.org/stable/c/082e378886547b5b1c4075ed307f7c68547868dc ↗
- https://git.kernel.org/stable/c/70cffc31a380b3eae45027101647aa94c242aa0e ↗
- https://git.kernel.org/stable/c/72a95df6bbc7d20c7af1e39d86b3e910cccd01ad ↗
- https://git.kernel.org/stable/c/eab46d9629807db1b5647d17227e16110a18227f ↗
- https://git.kernel.org/stable/c/da1ea35fea67ad841f4ada28dd61b41be65e5437 ↗