In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
i2c: stub: Reject I2C block transfers with invalid length<\/p>\n
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
\nas the transfer length. The existing check only clamps it to avoid
\noverrunning the chip->words[256] register array, but does not validate
\nit against I2C_SMBUS_BLOCK_MAX (32), which is the limit of the union
\ni2c_smbus_data.block buffer (34 bytes total). The driver is a
\ndevelopment\/test tool (CONFIG_I2C_STUB=m, not built by default)
\nthat must be loaded with a chip_addr= parameter.<\/p>\n
A local user with access to \/dev\/i2c-* can issue an I2C_SMBUS ioctl
\nwith I2C_SMBUS_I2C_BLOCK_DATA and data->block[0] > 32, causing
\nstub_xfer() to read or write past the end of the union
\ni2c_smbus_data.block buffer:<\/p>\n
BUG: KASAN: stack-out-of-bounds in stub_xfer (drivers\/i2c\/i2c-stub.c:223)
\n Read of size 1 at addr ffff88800abcfd92 by task exploit\/81
\n Call Trace:<\/p>\n
stub_xfer (drivers\/i2c\/i2c-stub.c:223)
\n __i2c_smbus_xfer (drivers\/i2c\/i2c-core-smbus.c:593)
\n i2c_smbus_xfer (drivers\/i2c\/i2c-core-smbus.c:536)
\n i2cdev_ioctl_smbus (drivers\/i2c\/i2c-dev.c:391)
\n i2cdev_ioctl (drivers\/i2c\/i2c-dev.c:478)
\n __x64_sys_ioctl (fs\/ioctl.c:583)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:130)<\/p>\n
The bug exists because i2c-stub implements .smbus_xfer directly,
\nbypassing the I2C_SMBUS_BLOCK_MAX validation in
\ni2c_smbus_xfer_emulated(). The I2C_SMBUS_BLOCK_DATA case in the same
\nfunction correctly validates against I2C_SMBUS_BLOCK_MAX, but the
\nI2C_SMBUS_I2C_BLOCK_DATA case does not.<\/p>\n
Fix by rejecting transfers with data->block[0] == 0 or
\ndata->block[0] > I2C_SMBUS_BLOCK_MAX with -EINVAL, consistent with
\nboth the I2C_SMBUS_BLOCK_DATA case in the same function and the
\nI2C_SMBUS_I2C_BLOCK_DATA validation in i2c_smbus_xfer_emulated().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
i2c: stub: Reject I2C block transfers with invalid length<\/p>\n
The I2C_SMBUS_I2C_BLOCK_DATA case in stub_xfer() uses data->block[0]
\nas <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15189","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}