In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/panthor: reject firmware sections with oversized data<\/p>\n
In panthor_fw_load_section_entry(), the data size to copy is calculated
\nwithout validating it against the allocated section_size:<\/p>\n
section->data.size = hdr.data.end – hdr.data.start;<\/p>\n
If a crafted firmware sets data.size larger than the allocated memory,
\nthis could cause a heap buffer overflow in panthor_fw_init_section_mem()<\/p>\n
memcpy(section->mem->kmap, section->data.buf, section->data.size);<\/p>\n
Additionally, if the section->data.size exceeds the BO size, could this
\nmemset underflow the size calculation, leading to a massive out-of-bounds
\nzeroing of kernel memory?<\/p>\n
memset(section->mem->kmap + section->data.size, 0,
\n panthor_kernel_bo_size(section->mem) – section->data.size);<\/p>\n
Reject section entries whose initial data is larger than the section size.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drm\/panthor: reject firmware sections with oversized data<\/p>\n
In panthor_fw_load_section_entry(), the data size to copy is calculated<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7440","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}