Описание
In the Linux kernel, the following vulnerability has been resolved:
Input: soc_button_array - check btns_desc->package.count
Check that btns_desc->package.count is not 0 before accessing
btns_desc->package.elements[0].
A flaw was found in the Linux kernel's SoC (System on Chip) button array driver. The driver fails to verify that the button descriptor package contains entries before accessing them during device initialization. This issue may allow an invalid device configuration to trigger an out-of-bounds memory access, resulting in a kernel crash and Denial of Service (DoS).
Отчет
A low impact out-of-bounds read flaw was found in the Linux kernel's soc_button_array driver used on SoC (System on Chip) platforms. The driver fails to verify that the ACPI button descriptor package contains any elements before accessing btns_desc->package.elements[0], so a device presenting a malformed ACPI configuration with a zero-length button descriptor package can trigger an out-of-bounds kernel memory read during device initialization, resulting in a driver probe failure or a kernel crash (denial of service). The flaw is local and not network reachable, and reliable triggering generally requires control over the platform's ACPI/firmware configuration or boot environment; this is why Red Hat rates the issue LOW impact even though the Red Hat CVSS:3.1 availability score is 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 10 kernels and Red Hat In-Vehicle OS 2 kernels (including kernel-ivos-qualcomm) are affected; the fix is currently deferred because this is a low-severity availability issue in device initialization, and the residual risk is limited to a local denial of service on systems whose ACPI button descriptor data is malformed or maliciously crafted. Red Hat Enterprise Linux 6, 7, 8, and 9 kernels (kernel and kernel-rt) and the RHEL CoreOS kernels used in OpenShift Container Platform are not affected because the vulnerable code is not present in those releases.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Not affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: Input: soc_button_array - check btns_desc->package.count Check that btns_desc->package.count is not 0 before accessing btns_desc->package.elements[0].
In the Linux kernel, the following vulnerability has been resolved: Input: soc_button_array - check btns_desc->package.count Check that btns_desc->package.count is not 0 before accessing btns_desc->package.elements[0].
In the Linux kernel, the following vulnerability has been resolved: I ...
In the Linux kernel, the following vulnerability has been resolved: Input: soc_button_array - check btns_desc->package.count Check that btns_desc->package.count is not 0 before accessing btns_desc->package.elements[0].
EPSS
5.5 Medium
CVSS3