In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
clk: meson: align gxbb_32k_clk_sel number of parents with actual count<\/p>\n
The following out-of-bounds read has been observed by Christian on a
\nGXBB WeTek Hub:
\n==================================================================
\nBUG: KASAN: global-out-of-bounds in __clk_register+0x1b70\/0x2418
\nRead of size 8 at addr ffffd66320cf88e0 by task swapper\/0\/1<\/p>\n
CPU: 0 UID: 0 PID: 1 Comm: swapper\/0 Not tainted 7.0.0-rc5 #1 PREEMPT
\nHardware name: WeTek Hub (DT)
\nCall trace:
\n show_stack+0x14\/0x20 (C)
\n dump_stack_lvl+0x74\/0x94
\n print_report+0x164\/0x4b0
\n kasan_report+0x98\/0xd8
\n __asan_report_load8_noabort+0x1c\/0x24
\n __clk_register+0x1b70\/0x2418
\n devm_clk_hw_register+0x74\/0x15c
\n meson_clkc_init+0xd4\/0x20c
\n meson_clkc_syscon_probe+0x5c\/0x94
\n platform_probe+0xbc\/0x17c
\n really_probe+0x184\/0x844
\n __driver_probe_device+0x154\/0x35c
\n driver_probe_device+0x60\/0x188
\n __driver_attach+0x168\/0x4a0
\n bus_for_each_dev+0xec\/0x180
\n driver_attach+0x38\/0x58
\n bus_add_driver+0x238\/0x4c0
\n driver_register+0x150\/0x388
\n __platform_driver_register+0x54\/0x7c
\n gxbb_clkc_driver_init+0x18\/0x20
\n do_one_initcall+0xb8\/0x340
\n kernel_init_freeable+0x49c\/0x52c
\n kernel_init+0x24\/0x148
\n ret_from_fork+0x10\/0x20<\/p>\n
The buggy address belongs to the variable:
\n gxbb_32k_clk_parents+0x60\/0x400<\/p>\n
The buggy address belongs to a vmalloc virtual mapping
\nThe buggy address belongs to the physical page:<\/p>\n
Memory state around the buggy address:
\n ffffd66320cf8780: 00 00 00 00 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
\n ffffd66320cf8800: 00 04 f9 f9 f9 f9 f9 f9 00 04 f9 f9 f9 f9 f9 f9
\n>ffffd66320cf8880: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
\n ^
\n ffffd66320cf8900: 00 01 f9 f9 f9 f9 f9 f9 00 06 f9 f9 f9 f9 f9 f9
\n ffffd66320cf8980: 00 00 02 f9 f9 f9 f9 f9 00 00 02 f9 f9 f9 f9 f9
\n==================================================================<\/p>\n
Commit 7915d7d5407c (“clk: amlogic: gxbb: drop non existing 32k clock
\nparent”) dropped a non-existing clock parent from the gxbb_32k_clk_sel
\nmux but didn’t adjust the hard-coded num_parents field. Fix the actual
\nnumber of parents of that mux by using ARRAY_SIZE instead (avoiding
\nsimilar problems in future).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
clk: meson: align gxbb_32k_clk_sel number of parents with actual count<\/p>\n
The following out-of-bounds read has been observed by Chris<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24634","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24634","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24634"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24634"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24634"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}