In the Linux kernel, the following vulnerability has been resolved:
net: stmmac: dwmac-rk: fix oob read in rk_gmac_setup
KASAN reports an out-of-bounds read in rk_gmac_setup on the line:
while (ops->regs[i]) {
This happens for most platforms since the regs flexible array member is empty, so the memory after the ops structure is being read here. It seems that mostly this happens to contain zero anyway, so we get lucky and everything still works.
To avoid adding redundant data to nearly all the ops structures, add a new flag to indicate whether the regs field is valid and avoid this loop when it is not.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Jun 19, 2024 |
| Suse | — | Upgrade kernel-rt_debug-develUpgrade kernel-devel-rtUpgrade kernel-devel-azureUpgrade cluster-md-kmp-rtUpgrade kernel-azureUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-rt-extraUpgrade gfs2-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-azure-optionalUpgrade kernel-rtUpgrade kernel-azure-develUpgrade kernel-rt-livepatchUpgrade kernel-rt-develUpgrade kernel-source-azureUpgrade cluster-md-kmp-azureUpgrade kernel-syms-azureUpgrade ocfs2-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-rt-livepatch-develUpgrade dlm-kmp-rtUpgrade kernel-source-rtUpgrade kselftests-kmp-rtUpgrade kselftests-kmp-azureUpgrade kernel-azure-extraUpgrade dlm-kmp-azureUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-rtUpgrade kernel-rt_debugUpgrade ocfs2-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-rt_debug-vdso | Aug 9, 2024 | Jun 19, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub