In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Input: cs40l50-vibra – validate custom data from user space<\/p>\n
cs40l50_add() copies the custom data of an FF_PERIODIC\/FF_CUSTOM effect
\nstraight from the ff_effect the user passed to EVIOCSFF, without
\nrequiring it to hold anything:<\/p>\n
work_data.custom_data = memdup_array_user(periodic->custom_data,
\n periodic->custom_len,
\n sizeof(s16));
\n work_data.custom_len = periodic->custom_len;<\/p>\n
The driver then reads two words out of that buffer: custom_data[0] as the
\nwaveform bank in cs40l50_effect_bank_set(), and custom_data[1] as the
\nindex within the bank in cs40l50_effect_index_set(). Neither read is
\ncovered by a length check, and custom_len is fully user controlled:<\/p>\n
– custom_len == 0 makes memdup_array_user() call memdup_user() with a
\n length of zero, which returns ZERO_SIZE_PTR rather than an error, so
\n custom_data[0] dereferences it.<\/p>\n
– custom_len == 1 allocates two bytes. A bank of ROM or RAM keeps
\n effect->type out of the OWT case, and custom_data[1] is then read one
\n word past the allocation.<\/p>\n
The bank value itself is also mishandled. It is masked with
\nCS40L50_CUSTOM_DATA_MASK (0xffff) but stored in an s16, so a
\ncustom_data[0] of 0x8000 or above wraps to a negative value that passes
\nthe “bank_type >= CS40L50_WVFRM_BANK_NUM” test.
\ncs40l50_effect_index_set() indexes vib->dsp.banks[] with it before the
\nswitch statement’s default case gets a chance to reject it:<\/p>\n
base_index = vib->dsp.banks[effect->type].base_index;
\n max_index = vib->dsp.banks[effect->type].max_index;<\/p>\n
Require the two words the driver reads to be present, and hold the masked
\nbank in a u32 so the existing upper-bound test covers the whole range.
\nThe da7280 haptic driver already range checks custom_len this way.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
Input: cs40l50-vibra – validate custom data from user space<\/p>\n
cs40l50_add() copies the custom data of an FF_PERIODIC\/FF_CUSTOM effec<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11973","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11973","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}