Description
In the Linux kernel, the following vulnerability has been resolved: i2c: ismt: Fix an out-of-bounds bug in ismt_access() When the driver does not check the data from the user, the variable 'data->block[0]' may be very large to cause an out-of-bounds bug. The following log can reveal it: [ 33.995542] i2c i2c-1: ioctl, cmd=0x720, arg=0x7ffcb3dc3a20 [ 33.995978] ismt_smbus 0000:00:05.0: I2C_SMBUS_BLOCK_DATA: WRITE [ 33.996475] ================================================================== [ 33.996995] BUG: KASAN: out-of-bounds in ismt_access.cold+0x374/0x214b [ 33.997473] Read of size 18446744073709551615 at addr ffff88810efcfdb1 by task ismt_poc/485 [ 33.999450] Call Trace: [ 34.001849] memcpy+0x20/0x60 [ 34.002077] ismt_access.cold+0x374/0x214b [ 34.003382] __i2c_smbus_xfer+0x44f/0xfb0 [ 34.004007] i2c_smbus_xfer+0x10a/0x390 [ 34.004291] i2cdev_ioctl_smbus+0x2c8/0x710 [ 34.005196] i2cdev_ioctl+0x5ec/0x74c Fix this bug by checking the size of 'data->block[0]' first.
Product status
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before 4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before 03b7ef7a6c5ca1ff553470166b4919db88b810f6
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before bfe41d966c860a8ad4c735639d616da270c92735
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before 9ac541a0898e8ec187a3fa7024b9701cffae6bf2
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before 96c12fd0ec74641295e1c3c34dea3dce1b6c3422
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before a642469d464b2780a25a49b51ae56623c65eac34
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before 233348a04becf133283f0076e20b317302de21d9
13f35ac14cd0a9a1c4f0034c4c40d0ae98844ce9 (git) before 39244cc754829bf707dccd12e2ce37510f5b1f8d
3.9
Any version before 3.9
4.9.337 (semver)
4.14.303 (semver)
4.19.270 (semver)
5.4.229 (semver)
5.10.163 (semver)
5.15.86 (semver)
6.0.16 (semver)
6.1.2 (semver)
6.2 (original_commit_for_fix)
References
git.kernel.org/...c/4a7bb1d93addb2f67e36fed00a53cb7f270d7b7a
git.kernel.org/...c/03b7ef7a6c5ca1ff553470166b4919db88b810f6
git.kernel.org/...c/bfe41d966c860a8ad4c735639d616da270c92735
git.kernel.org/...c/cdcbae2c5003747ddfd14e29db9c1d5d7e7c44dd
git.kernel.org/...c/9ac541a0898e8ec187a3fa7024b9701cffae6bf2
git.kernel.org/...c/96c12fd0ec74641295e1c3c34dea3dce1b6c3422
git.kernel.org/...c/a642469d464b2780a25a49b51ae56623c65eac34
git.kernel.org/...c/233348a04becf133283f0076e20b317302de21d9
git.kernel.org/...c/39244cc754829bf707dccd12e2ce37510f5b1f8d
