Description
In the Linux kernel, the following vulnerability has been resolved: media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() The buffer length check before calling uvc_parse_format() only ensured that the buffer has at least 3 bytes (buflen > 2), buf the function accesses buffer[3], requiring at least 4 bytes. This can lead to an out-of-bounds read if the buffer has exactly 3 bytes. Fix it by checking that the buffer has at least 4 bytes in uvc_parse_format().
Product status
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before 9ad554217c9b945031c73df4e8176a475e2dea57
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before 1e269581b3aa5962fdc52757ab40da286168c087
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before 8343f3fe0b755925f83d60b05e92bf4396879758
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before ffdd82182953df643aa63d999b6f1653d0c93778
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before cac702a439050df65272c49184aef7975fe3eff2
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before 424980d33b3f816485513e538610168b03fab9f1
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before 6d4a7c0b296162354b6fc759a1475b9d57ddfaa6
c0efd232929c2cd87238de2cccdaf4e845be5b0c (git) before 782b6a718651eda3478b1824b37a8b3185d2740c
2.6.26
Any version before 2.6.26
5.4.297 (semver)
5.10.241 (semver)
5.15.190 (semver)
6.1.149 (semver)
6.6.103 (semver)
6.12.43 (semver)
6.15.11 (semver)
6.16.2 (semver)
6.17 (original_commit_for_fix)
References
git.kernel.org/...c/9ad554217c9b945031c73df4e8176a475e2dea57
git.kernel.org/...c/1e269581b3aa5962fdc52757ab40da286168c087
git.kernel.org/...c/8343f3fe0b755925f83d60b05e92bf4396879758
git.kernel.org/...c/ffdd82182953df643aa63d999b6f1653d0c93778
git.kernel.org/...c/a97e062e4ff3dab84a2f1eb811e9eddc6699e2a9
git.kernel.org/...c/cac702a439050df65272c49184aef7975fe3eff2
git.kernel.org/...c/424980d33b3f816485513e538610168b03fab9f1
git.kernel.org/...c/6d4a7c0b296162354b6fc759a1475b9d57ddfaa6
git.kernel.org/...c/782b6a718651eda3478b1824b37a8b3185d2740c
