In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
power: supply: cros_usbpd-charger: bound the EC-reported port count<\/p>\n
cros_usbpd_charger_probe() reads two port counts from the EC and uses
\none of them, num_charger_ports, as the loop bound when populating a
\nfixed-size array:<\/p>\n
\tstruct port_data *ports[EC_USB_PD_MAX_PORTS];\t\/* 8 entries *\/
\n\t…
\n\tfor (i = 0; i num_charger_ports; i++)
\n\t\tcharger->ports[charger->num_registered_psy++] = port;<\/p>\n
Both num_usbpd_ports (from EC_CMD_USB_PD_PORTS) and num_charger_ports
\n(from EC_CMD_CHARGE_PORT_COUNT) are u8 values reported by the EC. The
\nonly validation is a sanity check that compares the two EC-reported
\nvalues against each other:<\/p>\n
\tif (num_charger_ports num_usbpd_ports + 1)
\n\t\treturn -EPROTO;<\/p>\n
It never checks either count against EC_USB_PD_MAX_PORTS, the size of
\nthe ports[] array. A malfunctioning, malicious or compromised EC that
\nreports num_usbpd_ports == num_charger_ports == N for any N > 8 (for
\nexample both 255) passes this check, and the loop then writes N pointers
\ninto the 8-entry ports[] array embedded in the devm_kzalloc()’d
\ncharger_data, overflowing it by up to 255 – 8 = 247 entries (~1976
\nbytes): a slab out-of-bounds write.<\/p>\n
Reject a port count larger than the ports[] array can hold.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
power: supply: cros_usbpd-charger: bound the EC-reported port count<\/p>\n
cros_usbpd_charger_probe() reads two port counts from the EC a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21393","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21393","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21393"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21393"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21393"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}