In the Linux kernel, the following vulnerability has been resolved:
cxl/features: Clamp Get Feature output size to the remaining buffer
cxl_get_feature() reads a feature in a loop but passes a fixed size_out as the output capacity every iteration. On the last partial iteration the buffer has less room left, so a device that returns more than asked can overflow feat_out.
Use the per-iter size data_to_rd_size, which already tracks the remaining room, as the output capacity.
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub