In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: amd_sfh: Validate PCI BAR size before mapping<\/p>\n
The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
\nsubsequently accesses MMIO registers at offsets up to 0x10958 (e.g.,
\nAMD_P2C_MSG3 at 0x1068C). However, the driver never validates that the BAR
\nsize is large enough to cover these accesses. If the driver is bound to a
\ndevice with a smaller BAR 2, this leads to an out-of-bounds memory access
\nand a page fault during the probe function.<\/p>\n
For example, a page fault can occur when reading from privdata->mmio +
\nAMD_P2C_MSG3 in mp2_select_ops():<\/p>\n
BUG: unable to handle page fault for address: ffffc9000390368c
\n PGD 100000067 P4D 100000067 PUD 1012c1067 PMD 105b64067 PTE 0
\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI
\n RIP: 0010:readl arch\/x86\/include\/asm\/io.h:59 [inline]
\n RIP: 0010:mp2_select_ops drivers\/hid\/amd-sfh-hid\/amd_sfh_pcie.c:282
\n [inline]
\n RIP: 0010:amd_mp2_pci_probe+0x337\/0x5f0
\n drivers\/hid\/amd-sfh-hid\/amd_sfh_pcie.c:487
\n Call Trace:<\/p>\n
local_pci_probe drivers\/pci\/pci-driver.c:332 [inline]
\n pci_call_probe drivers\/pci\/pci-driver.c:394 [inline]
\n __pci_device_probe drivers\/pci\/pci-driver.c:455 [inline]
\n pci_device_probe+0x431\/0xc90 drivers\/pci\/pci-driver.c:489<\/p>\n
Fix this by verifying that the length of BAR 2 is at least 128KB before
\nattempting to map it. Since the maximum accessed offset is 0x10958, and PCI
\nBAR sizes are powers of 2, any legitimate hardware will have a BAR size of
\nat least 128KB.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
HID: amd_sfh: Validate PCI BAR size before mapping<\/p>\n
The amd_sfh driver maps PCI BAR 2 using pcim_iomap_regions() and
\nsubsequently a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41112","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41112","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41112"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41112"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41112"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}