In the Linux kernel, the following vulnerability has been resolved:
iio: health: afe4404: Fix oob read in afe4404_[read|write]_raw
KASAN report out-of-bounds read as follows:
BUG: KASAN: global-out-of-bounds in afe4404_read_raw+0x2ce/0x380 Read of size 4 at addr ffffffffc00e4658 by task cat/278
Call Trace: afe4404_read_raw iio_read_channel_info dev_attr_show
The buggy address belongs to the variable: afe4404_channel_leds+0x18/0xffffffffffffe9c0
This issue can be reproduce by singe command:
$ cat /sys/bus/i2c/devices/0-0058/iio\:device0/in_intensity6_raw
The array size of afe4404_channel_leds and afe4404_channel_offdacs are less than channels, so access with chan->address cause OOB read in afe4404_[read|write]_raw. Fix it by moving access before use them.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Oct 23, 2024 | Oct 23, 2024 |
| Ubuntu | — | Upgrade linux-hwe-5.15Upgrade linux-iotUpgrade linux-lowlatency-hwe-5.15Upgrade linux-lowlatencyUpgrade linux-oracle-5.4Upgrade linux-intel-iotgUpgrade linux-realtimeUpgrade linux-kvmUpgrade linux-aws-5.4Upgrade linux-azure-5.4Upgrade linux-raspi-5.4Upgrade linux-aws-hweUpgrade linux-nvidiaUpgrade linux-gkeop-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-azureUpgrade linux-bluefieldUpgrade linux-awsUpgrade linux-azure-4.15Upgrade linux-raspiUpgrade linux-xilinx-zynqmpUpgrade linux-oracleUpgrade linux-aws-5.15Upgrade linux-gkeUpgrade linux-azure-fdeUpgrade linux-gcp-5.15Upgrade linux-hweUpgrade linux-oracle-5.15Upgrade linux-gcp-4.15Upgrade linux-azure-fipsUpgrade linux-gkeopUpgrade linuxUpgrade linux-gcp-fipsUpgrade linux-nvidia-tegra-5.15Upgrade linux-gcpUpgrade linux-ibm-5.4Upgrade linux-hwe-5.4Upgrade linux-riscv-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-aws-fipsUpgrade linux-azure-5.15Upgrade linux-fipsUpgrade linux-gcp-5.4Upgrade linux-ibm | Nov 19, 2024 | Oct 21, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Oct 21, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub