Description
In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
- side A configures the n_gsm in basic option mode
- side B sends the header of a basic option mode frame with data length 1
- side A switches to advanced option mode
- side B sends 2 data bytes which exceeds gsm->len
Reason: gsm->len is not used in advanced option mode.
- side A switches to basic option mode
- side B keeps sending until gsm0_receive() writes past gsm->buf
Reason: Neither gsm->state nor gsm->len have been reset after
reconfiguration.
Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.
Produits et versions touchés
| Produit |
Versions touchées |
Corrigé en |
|
Linux
6.10
|
premières → < 6.10
|
6.10
|
|
Linux
6.9
|
premières → < 6.9.3
|
6.9.3
|
|
Linux
6.8
|
premières → < 6.8.12
|
6.8.12
|
|
Linux
6.6
|
premières → < 6.6.33
|
6.6.33
|
|
Linux
6.1
|
premières → < 6.1.93
|
6.1.93
|
|
Linux
5.15
|
premières → < 5.15.161
|
5.15.161
|
|
Linux
5.10
|
premières → < 5.10.219
|
5.10.219
|
|
Linux
5.4
|
premières → < 5.4.278
|
5.4.278
|
|
Linux
4.19
|
premières → < 4.19.316
|
4.19.316
|
Afficher les 15 autres branches
Masquer les 15 autres branches