Description
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate curve data length in the calibration curve converters p54_convert_rev0() and p54_convert_rev1() read calibration curve data from the device-supplied EEPROM entry using channel and points-per-channel counts taken verbatim from that same entry, so an entry that declares more data than it carries drives an out-of-bounds read past the EEPROM buffer (verified with a KASAN reproducer of the conversion loop). The sibling converters p54_convert_output_limits() and p54_convert_db() already validate their counts against the entry length; this path was missed. Reject the entry when the counts do not fit in the entry data.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
eff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 81084c967c18233b19799a0c3352ebac043f31e2affectedeff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 41cdf14bf4b52fbe4673a172c2a6ad756cb08111affectedeff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 03d313e3dfb49a44c10a5c423452967694fb85e2affectedeff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 42f4b03971f9d6329c4cbd1ea5155210d16ab65baffectedeff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 4d767d6f8753db22bfc14c2724bd9cee677ffb03affectedeff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < 3bdcc4d61212b001b8752d80036509b4974ce16caffectedeff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < b0c906107150b16925ee66da09127259864c7f36affectedeff1a59c48e3c6a006eb4fe5f2e405a996f2259d to < ce858fa6b8a214dee5adb82358885fa024cdd887affected
Linux Linux
Default version status: affected
2.6.24affected0 to < 2.6.24unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.54 to ≤ 6.18.*unaffected7.2.8 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/81084c967c18233b19799a0c3352ebac043f31e2 ↗
- https://git.kernel.org/stable/c/41cdf14bf4b52fbe4673a172c2a6ad756cb08111 ↗
- https://git.kernel.org/stable/c/03d313e3dfb49a44c10a5c423452967694fb85e2 ↗
- https://git.kernel.org/stable/c/42f4b03971f9d6329c4cbd1ea5155210d16ab65b ↗
- https://git.kernel.org/stable/c/4d767d6f8753db22bfc14c2724bd9cee677ffb03 ↗
- https://git.kernel.org/stable/c/3bdcc4d61212b001b8752d80036509b4974ce16c ↗
- https://git.kernel.org/stable/c/b0c906107150b16925ee66da09127259864c7f36 ↗
- https://git.kernel.org/stable/c/ce858fa6b8a214dee5adb82358885fa024cdd887 ↗