In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86: hp-bioscfg: pass validated element count to package parsers<\/p>\n
The per-type package parsers are handed the wrong element count.<\/p>\n
hp_init_bios_package_attribute() validates obj->package.count and then
\ncalls one of the five hp_populate_*_package_data() wrappers (string,
\ninteger, enumeration, ordered list, password). Each wrapper forwards a
\ncount to its hp_populate_*_elements_from_package() parser, but instead
\nof forwarding the validated obj->package.count it derives the count
\nfrom elements[0]. elements[0] is the NAME field and is always an
\nACPI_TYPE_STRING, so reading ->package.count from it in fact reads
\n->string.length through the union acpi_object. The parsers thus bound
\nthemselves against the length of the name string rather than against
\nthe real number of elements in the package.<\/p>\n
This is safe today because hp_init_bios_package_attribute() refuses any
\npackage that has fewer than the type’s element count, so a parser only
\never runs on a full package and never reads past it regardless of the
\nbogus bound.<\/p>\n
An upcoming change relaxes that check to accept shorter packages. Once
\na parser can receive fewer elements than its per-type count, a bound
\ntaken from the name length no longer reflects the array size, and the
\n“elem = count” sub-loop guards
\nread past the end of elements[] – an out-of-bounds heap read.<\/p>\n
Forward the validated obj->package.count to every *_package_data()
\nwrapper so the parsers bound themselves against the real package size.
\nThis does not change behaviour for the packages that enumerate
\ncorrectly today and is a prerequisite for accepting shorter packages
\nsafely.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86: hp-bioscfg: pass validated element count to package parsers<\/p>\n
The per-type package parsers are handed the wrong elemen<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21344","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}