In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
accel\/ivpu: Reject firmware log with size smaller than header<\/p>\n
fw_log_from_bo() validates the tracing buffer header_size and that the
\nlog fits within the BO, but never checks that log->size is at least
\nlog->header_size. fw_log_print_buffer() then computes:<\/p>\n
u32 data_size = log->size – log->header_size;<\/p>\n
which underflows to a near-U32_MAX value when firmware reports a log whose
\nsize is smaller than its header. That huge data_size defeats the
\nlog_start\/log_end bounds clamps added by commit dd1311bcf0e6 (“accel\/ivpu:
\nAdd bounds checks for firmware log indices”), so fw_log_print_lines() reads
\nfar past the small real data region of the BO. A size of 0 also makes
\nfw_log_from_bo() advance the offset by 0, causing the callers to loop
\nforever on the same header.<\/p>\n
Reject logs whose size is smaller than the header (which also rejects
\nsize == 0).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
accel\/ivpu: Reject firmware log with size smaller than header<\/p>\n
fw_log_from_bo() validates the tracing buffer header_size and that t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6765","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6765"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6765"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}