In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86: hp-bioscfg: fix heap OOB read on empty password write<\/p>\n
validate_password_input() computes length = strlen(buf) and then
\nchecks buf[length – 1] to strip a trailing newline, without checking
\nthat length is nonzero first. Writing an empty string (a bare ‘n’)
\nto current_password or new_password gives length == 0, and
\nbuf[length – 1] reads buf[-1], one byte before the heap allocation
\nholding the copied input.<\/p>\n
KASAN confirms this directly:<\/p>\n
BUG: KASAN: slab-out-of-bounds in store_password_instance.constprop.0+0x223\/0x2a0 [hp_bioscfg]
\n Read of size 1 at addr ffff88811bd8da9f by task sh\/13740
\n …
\n store_password_instance.constprop.0+0x223\/0x2a0 [hp_bioscfg]
\n current_password_store+0x14\/0x20 [hp_bioscfg]
\n …
\n The buggy address is located 23 bytes to the right of
\n allocated 8-byte region [ffff88811bd8da80, ffff88811bd8da88)<\/p>\n
Reproduced identically via new_password_store. Execution continues
\npast the bad read (the garbage byte only affects whether “length” is
\ndecremented by one), so the write completes and returns success; this
\nis a pure information read past the buffer, not a crash, but it is
\nstill an out-of-bounds access KASAN correctly flags.<\/p>\n
Fix by only checking buf[length – 1] when length is nonzero.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86: hp-bioscfg: fix heap OOB read on empty password write<\/p>\n
validate_password_input() computes length = strlen(buf) and th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21346","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21346","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21346"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21346"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21346"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}