In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]<\/p>\n
acpi_pcc_retrieve_biosdata() rejects SINF packages only when
\npcc->num_sifr is strictly less than hkey->package.count, then
\nunconditionally writes a trailing sentinel at
\npcc->sinf[hkey->package.count]. But pcc->sinf[] is allocated with
\nexactly pcc->num_sifr elements (valid indices 0..num_sifr-1), so that
\nwrite needs num_sifr strictly greater than package.count to stay in
\nbounds — num_sifr == package.count passes the existing check but
\nstill overflows by one element.<\/p>\n
This is exactly the case probe()’s existing num_sifr++ workaround
\n(“Some DSDT-s have an off-by-one bug where the SINF package count is
\none higher than the SQTY reported value”) is written to accommodate:
\nwhen a DSDT’s SINF package count equals SQTY+1, the workaround makes
\nnum_sifr equal to package.count, which is precisely the boundary that
\noverflows here. Found via UBSan (array-index-out-of-bounds) on
\nhardware where HKEY.SQTY returns 37 and HKEY.SINF()’s package has 38
\nelements: num_sifr becomes 38 after the += 1 workaround, the loop
\ncorrectly fills indices 0..37, and the sentinel write then targets
\nindex 38, one past the end — a silent 4-byte heap overflow on kernels
\nwithout CONFIG_UBSAN.<\/p>\n
Tightening the rejection check to num_sifr <= package.count would
\navoid the overflow but breaks probe() entirely on exactly this
\nhardware, since num_sifr == package.count is the case the off-by-one
\nworkaround exists to support. Nothing else in the driver reads this
\nsentinel value back, so simply skip the write when there is no room
\nfor it instead.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
platform\/x86: panasonic-laptop: Fix sentinel write past pcc->sinf[]<\/p>\n
acpi_pcc_retrieve_biosdata() rejects SINF packages only when
\np<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21358","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}