Описание
In the Linux kernel, the following vulnerability has been resolved:
drm/panthor: harden firmware build-info bounds checks
panthor_fw_read_build_info() checks whether the metadata range fits in the firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation.
The function also reads the "git_sha: " prefix without first checking that the metadata is long enough, and meta_size == 0 can underflow the NULL terminator index.
Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte.
EPSS
7.1 High
CVSS3
Дефекты
Связанные уязвимости
(In the Linux kernel, the following vulnerability has been resolved: d ...)
In the Linux kernel, the following vulnerability has been resolved: d ...
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: harden firmware build-info bounds checks panthor_fw_read_build_info() checks whether the metadata range fits in the firmware image with hdr.meta_start + hdr.meta_size. Both fields are u32, so the addition can wrap and let an out-of-bounds range pass validation. The function also reads the "git_sha: " prefix without first checking that the metadata is long enough, and meta_size == 0 can underflow the NULL terminator index. Use subtraction-based bounds checking and reject metadata that is too short to contain the expected prefix and trailing NULL byte.
EPSS
7.1 High
CVSS3