In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: extend bcm_tx_lock usage for data and timer updates<\/p>\n
Stage new CAN frame content for an existing tx op into a kmalloc()’d
\nbuffer and validate it there, mirroring the approach already used in
\nbcm_rx_setup(). Only copy the validated data into op->frames while
\nholding op->bcm_tx_lock, so bcm_can_tx() and bcm_tx_timeout_handler()
\ncan no longer observe a partially updated or unvalidated frame.<\/p>\n
Add a missing error path for memcpy_from_msg() when copying CAN frame
\ndata from userspace.<\/p>\n
Also move the kt_ival1\/kt_ival2\/ival1\/ival2 updates in bcm_tx_setup()
\nunder op->bcm_tx_lock, and read kt_ival1\/kt_ival2\/count under the same
\nlock in bcm_tx_set_expiry() and bcm_tx_timeout_handler(), closing the
\ntorn 64-bit ktime_t read on 32-bit platforms.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
can: bcm: extend bcm_tx_lock usage for data and timer updates<\/p>\n
Stage new CAN frame content for an existing tx op into a kmalloc()’d<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6785","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}