| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nacpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl\n\nFix an issue detected by syzbot with KASAN:\n\nBUG: KASAN: vmalloc-out-of-bounds in cmd_to_func drivers/acpi/nfit/\ncore.c:416 [inline]\nBUG: KASAN: vmalloc-out-of-bounds in acpi_nfit_ctl+0x20e8/0x24a0\ndrivers/acpi/nfit/core.c:459\n\nThe issue occurs in cmd_to_func when the call_pkg->nd_reserved2\narray is accessed without verifying that call_pkg points to a buffer\nthat is appropriately sized as a struct nd_cmd_pkg. This can lead\nto out-of-bounds access and undefined behavior if the buffer does not\nhave sufficient space.\n\nTo address this, a check was added in acpi_nfit_ctl() to ensure that\nbuf is not NULL and that buf_len is less than sizeof(*call_pkg)\nbefore accessing it. This ensures safe access to the members of\ncall_pkg, including the nd_reserved2 array." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/acpi/nfit/core.c" |
| ], |
| "versions": [ |
| { |
| "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102", |
| "lessThan": "616aa5f3c86e0479bcbb81e41c08c43ff32af637", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102", |
| "lessThan": "bbdb3307f609ec4dc9558770f464ede01fe52aed", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102", |
| "lessThan": "143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102", |
| "lessThan": "e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102", |
| "lessThan": "212846fafb753a48e869e2a342fc1e24048da771", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "ebe9f6f19d80d8978d16078dff3d5bd93ad8d102", |
| "lessThan": "265e98f72bac6c41a4492d3e30a8e5fd22fe0779", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "63108f2a408abea7ecab063efa0f398da4d0d14b", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "f5878c4f084dc6b1386dad03970bb61ad5e9dc4b", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "0c79794474895dbbc3c52225f7e9f73cfecbb7dd", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "drivers/acpi/nfit/core.c" |
| ], |
| "versions": [ |
| { |
| "version": "5.1", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "5.1", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.10.232", |
| "lessThanOrEqual": "5.10.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.175", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.121", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.67", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.12.6", |
| "lessThanOrEqual": "6.12.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.13", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.1", |
| "versionEndExcluding": "5.10.232" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.1", |
| "versionEndExcluding": "5.15.175" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.1", |
| "versionEndExcluding": "6.1.121" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.1", |
| "versionEndExcluding": "6.6.67" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.1", |
| "versionEndExcluding": "6.12.6" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.1", |
| "versionEndExcluding": "6.13" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.14.176" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "4.19.31" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.0.4" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/616aa5f3c86e0479bcbb81e41c08c43ff32af637" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/bbdb3307f609ec4dc9558770f464ede01fe52aed" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/212846fafb753a48e869e2a342fc1e24048da771" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/265e98f72bac6c41a4492d3e30a8e5fd22fe0779" |
| } |
| ], |
| "title": "acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2024-56662", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
