In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hwmon: (pmbus\/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR<\/p>\n
adm1266_gpio_get_multiple() iterates the PDIO portion of the
\ncaller-supplied mask using<\/p>\n
\tfor_each_set_bit_from(gpio_nr, mask,
\n\t\t\t ADM1266_GPIO_NR + ADM1266_PDIO_STATUS) {
\n\t\t…
\n\t}<\/p>\n
where ADM1266_PDIO_STATUS is the PMBus command code (0xE9, i.e. 233),
\nnot the number of PDIO pins. The intended upper bound is
\nADM1266_GPIO_NR + ADM1266_PDIO_NR = 25.<\/p>\n
gpiolib hands in a mask sized for gc.ngpio (= 25 bits on this chip),
\nso the iteration walks find_next_bit() up to 242, reading up to 217
\nextra bits (a handful of unsigned-long words: four on 64-bit, seven
\non 32-bit) of whatever lives past the end of the mask in the
\ncaller’s stack. Any incidental set bit in that range then drives a
\nset_bit(gpio_nr, bits) call that writes past the end of the
\ncaller-supplied bits array too — both out-of-bounds.<\/p>\n
Substitute ADM1266_PDIO_NR for the constant so the scan stops at the
\nlast real PDIO bit.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hwmon: (pmbus\/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR<\/p>\n
adm1266_gpio_get_multiple() iterates the PDIO portion of t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15062","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15062","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15062"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15062"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15062"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}