In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: Validate GPIO pin LUT table size before iterating<\/p>\n
[Why&How]
\nThe GPIO pin table parsers in get_gpio_i2c_info() and
\nbios_parser_get_gpio_pin_info() derive an element count from the VBIOS
\ntable_header.structuresize field, then iterate over gpio_pin[] entries.
\nHowever, GET_IMAGE() only validates that the table header itself fits
\nwithin the BIOS image. If the VBIOS reports a structuresize larger than
\nthe actual mapped data, the loop reads past the end of the BIOS image,
\ncausing an out-of-bounds read.<\/p>\n
Fix this by calling bios_get_image() to validate that the full claimed
\nstructuresize is accessible within the BIOS image before entering the
\nloop in both functions.<\/p>\n
(cherry picked from commit ba5e95b43b773ae1bf1f66ee6b31eb774e65afe3)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/amd\/display: Validate GPIO pin LUT table size before iterating<\/p>\n
[Why&How]
\nThe GPIO pin table parsers in get_gpio_i2c_info() and<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15071","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15071","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15071"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15071"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15071"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}