In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/bridge: tc358767: clamp the reported AUX read size to the request<\/p>\n
tc_aux_transfer() clamps an AUX read to the payload limit:<\/p>\n
\tsize_t size = min_t(size_t, DP_AUX_MAX_PAYLOAD_BYTES – 1, msg->size);<\/p>\n
After the transfer it replaces size with the byte count the controller
\nreports in AUX_BYTES:<\/p>\n
\tif (size)
\n\t\tsize = FIELD_GET(AUX_BYTES, auxstatus);<\/p>\n
AUX_BYTES is GENMASK(15, 8), so it can be up to 255. Nothing clamps it
\nback to the request. tc_aux_read_data() reads that many bytes into the
\n16-byte auxrdata stack buffer, then copies them into the caller buffer. A
\nreported count of 255 makes the read run to 256 bytes and overruns both.<\/p>\n
The controller should never report more than it was asked to transfer, so
\nthis is defense in depth rather than a live hole. The reported count is
\nonly lightly trusted, and the check is cheap. Clamp it back to the request,
\nthe same way ti-sn65dsi86 does in commit aca58eac52b8 (“drm\/bridge:
\nti-sn65dsi86: Never store more than msg->size bytes in AUX xfer”).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/bridge: tc358767: clamp the reported AUX read size to the request<\/p>\n
tc_aux_transfer() clamps an AUX read to the payload limit:<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25926","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25926"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25926"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}