| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2022-49612: power: supply: core: Fix boundary conditions in interpolation |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| power: supply: core: Fix boundary conditions in interpolation |
| |
| The functions power_supply_temp2resist_simple and power_supply_ocv2cap_simple |
| handle boundary conditions incorrectly. |
| The change was introduced in a4585ba2050f460f749bbaf2b67bd56c41e30283 |
| ("power: supply: core: Use library interpolation"). |
| There are two issues: First, the lines "high = i - 1" and "high = i" in ocv2cap |
| have the wrong order compared to temp2resist. As a consequence, ocv2cap |
| sets high=-1 if ocv>table[0].ocv, which causes an out-of-bounds read. |
| Second, the logic of temp2resist is also not correct. |
| Consider the case table[] = {{20, 100}, {10, 80}, {0, 60}}. |
| For temp=5, we expect a resistance of 70% by interpolation. |
| However, temp2resist sets high=low=2 and returns 60. |
| |
| The Linux kernel CVE team has assigned CVE-2022-49612 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.17 with commit a4585ba2050f460f749bbaf2b67bd56c41e30283 and fixed in 5.18.13 with commit a762cee5d933fe4e2e1b773d60fc74fb8248d8c4 |
| Issue introduced in 5.17 with commit a4585ba2050f460f749bbaf2b67bd56c41e30283 and fixed in 5.19 with commit 093d27bb6f2d1963f927ef59c9a2d37059175426 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2022-49612 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| drivers/power/supply/power_supply_core.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/a762cee5d933fe4e2e1b773d60fc74fb8248d8c4 |
| https://git.kernel.org/stable/c/093d27bb6f2d1963f927ef59c9a2d37059175426 |
