Description
In the Linux kernel, the following vulnerability has been resolved: drm/i915/dmc: Harden DMC firmware payload parsing Validate the conversion of the DMC firmware size from dwords to bytes using check_mul_overflow() before calculating the firmware payload size. Reject zero-length payloads and zero MMIO counts in the DMC firmware header so malformed firmware is caught early. Also set dmc_fw_size only after the payload allocation succeeds. (cherry picked from commit efde6601a1f1daedfe3dcc2816c934ddb44e3eef)
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
eb805623d8b161342ed9c9caf366f0a295041a6d to < 0e396088fa5c1f96ff43de29c2a2f8807078723daffectedeb805623d8b161342ed9c9caf366f0a295041a6d to < 53068cf3851dd4e00e8e668563e0353d9d79a98baffectedeb805623d8b161342ed9c9caf366f0a295041a6d to < e33921271d4438f4a24014f560e5ab297d7eda3faffectedeb805623d8b161342ed9c9caf366f0a295041a6d to < 4589ad76a6b1011538600ad398baf0b7d73a1252affectedeb805623d8b161342ed9c9caf366f0a295041a6d to < eb7a0ba650d607976d1a0a5e7501d3f14b35d026affectedeb805623d8b161342ed9c9caf366f0a295041a6d to < dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aaaffectedeb805623d8b161342ed9c9caf366f0a295041a6d to < 05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6daffectedeb805623d8b161342ed9c9caf366f0a295041a6d to < 8bb1858db453cd4250e3b633f5d2d09206024ca6affected
Linux Linux
Default version status: affected
4.2affected0 to < 4.2unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.161 to ≤ 6.6.*unaffected6.12.115 to ≤ 6.12.*unaffected6.18.59 to ≤ 6.18.*unaffected7.2.13 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0e396088fa5c1f96ff43de29c2a2f8807078723d ↗
- https://git.kernel.org/stable/c/53068cf3851dd4e00e8e668563e0353d9d79a98b ↗
- https://git.kernel.org/stable/c/e33921271d4438f4a24014f560e5ab297d7eda3f ↗
- https://git.kernel.org/stable/c/4589ad76a6b1011538600ad398baf0b7d73a1252 ↗
- https://git.kernel.org/stable/c/eb7a0ba650d607976d1a0a5e7501d3f14b35d026 ↗
- https://git.kernel.org/stable/c/dfcfe2874e7c16e8460dc86ac1eeb54ea0e7f8aa ↗
- https://git.kernel.org/stable/c/05f7a2f712f8b287a98ee61a7c2c6b72dad2fc6d ↗
- https://git.kernel.org/stable/c/8bb1858db453cd4250e3b633f5d2d09206024ca6 ↗