In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: mcp2221: clear rxbuf after I2C\/SMBus transfer completes<\/p>\n
mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in
\nmcp->rxbuf for the duration of a transfer but never clears it when the
\ntransfer finishes or times out. Once the caller frees or reuses the
\nbuffer, mcp->rxbuf becomes a dangling pointer. A delayed or spurious
\nMCP2221_I2C_GET_DATA report can then drive mcp2221_raw_event() to
\nmemcpy device data into the freed memory, causing a write
\nuse-after-free.<\/p>\n
Route all return paths through a single exit point that clears
\nmcp->rxbuf and mcp->rxbuf_size, so that the existing !mcp->rxbuf guard
\nin the raw_event handler can reject any report arriving after the
\ntransfer has ended.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: mcp2221: clear rxbuf after I2C\/SMBus transfer completes<\/p>\n
mcp_i2c_smbus_read() stores the caller-supplied buffer pointer in
\nmcp<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21544","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21544","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21544"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21544"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21544"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}