Description
In the Linux kernel, the following vulnerability has been resolved: spi: ch341: fix out-of-bounds memory access in ch341_transfer_one Discovered by Atuin - Automated Vulnerability Discovery Engine. The 'len' variable is calculated as 'min(32, trans->len + 1)', which includes the 1-byte command header. When copying data from 'trans->tx_buf' to 'ch341->tx_buf + 1', using 'len' as the length is incorrect because: 1. It causes an out-of-bounds read from 'trans->tx_buf' (which has size 'trans->len', i.e., 'len - 1' in this context). 2. It can cause an out-of-bounds write to 'ch341->tx_buf' if 'len' is CH341_PACKET_LENGTH (32). Writing 32 bytes to ch341->tx_buf + 1 overflows the buffer. Fix this by copying 'len - 1' bytes.
Product status
8846739f52afa07e63395c80227dc544f54bd7b1 (git) before cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974
8846739f52afa07e63395c80227dc544f54bd7b1 (git) before ea1e43966cd03098fcd5f0d72e6c2901d45fa08d
8846739f52afa07e63395c80227dc544f54bd7b1 (git) before 81841da1f30f66a850cc8796d99ba330aad9d696
8846739f52afa07e63395c80227dc544f54bd7b1 (git) before 545d1287e40a55242f6ab68bcc1ba3b74088b1bc
6.11
Any version before 6.11
6.12.63 (semver)
6.17.13 (semver)
6.18.2 (semver)
6.19 (original_commit_for_fix)
References
git.kernel.org/...c/cad6c0fd6f3c0e76a1f75df4bce3b08a13f08974
git.kernel.org/...c/ea1e43966cd03098fcd5f0d72e6c2901d45fa08d
git.kernel.org/...c/81841da1f30f66a850cc8796d99ba330aad9d696
git.kernel.org/...c/545d1287e40a55242f6ab68bcc1ba3b74088b1bc