In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cpufreq: imx6q: fix out-of-bounds write when probed more than once<\/p>\n
imx6_soc_volt is allocated fresh on every probe, sized to the number of
\nARM OPPs:<\/p>\n
\timx6_soc_volt = devm_kcalloc(cpu_dev, num, sizeof(*imx6_soc_volt),
\n\t\t\t\t GFP_KERNEL);<\/p>\n
but it is filled through soc_opp_count, which has static storage and is
\nnever reset. A second bind after an unbind keeps indexing from where the
\nfirst one stopped, and writes past the end of the new array.<\/p>\n
Unbinding and rebinding the driver on qemu’s mcimx6ul-evk, under KASAN:<\/p>\n
BUG: KASAN: slab-out-of-bounds in imx6q_cpufreq_probe+0x3b0\/0xa34
\n Write of size 4 at addr c5e90480 by task binder\/73
\n imx6q_cpufreq_probe from platform_probe+0x88\/0xe4
\n platform_probe from really_probe+0x108\/0x384
\n bind_store from kernfs_fop_write_iter+0x1b4\/0x28c<\/p>\n
The write lands one u32 past the end of the allocation.<\/p>\n
soc_opp_count is only read a few lines below the loop that fills it, so it
\nnever needed static storage. Make it a local.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cpufreq: imx6q: fix out-of-bounds write when probed more than once<\/p>\n
imx6_soc_volt is allocated fresh on every probe, sized to the n<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25704","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25704","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25704"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25704"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25704"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}