CVE-2024-38621
media: stk1160: fix bounds checking in stk1160_copy_video()
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
In the Linux kernel, the following vulnerability has been resolved:
media: stk1160: fix bounds checking in stk1160_copy_video()
The subtract in this condition is reversed. The ->length is the length
of the buffer. The ->bytesused is how many bytes we have copied thus
far. When the condition is reversed that means the result of the
subtraction is always negative but since it's unsigned then the result
is a very high positive value. That means the overflow check is never
true.
Additionally, the ->bytesused doesn't actually work for this purpose
because we're not writing to "buf->mem + buf->bytesused". Instead, the
math to calculate the destination where we are writing is a bit
involved. You calculate the number of full lines already written,
multiply by two, skip a line if necessary so that we start on an odd
numbered line, and add the offset into the line.
To fix this buffer overflow, just take the actual destination where we
are writing, if the offset is already out of bounds print an error and
return. Otherwise, write up to buf->length bytes.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: medios: stk1160: revisión de los límites fijos en stk1160_copy_video() La resta en esta condición se invierte. La ->longitud es la longitud del búfer. El ->byteused es cuántos bytes hemos copiado hasta ahora. Cuando la condición se invierte, eso significa que el resultado de la resta siempre es negativo, pero como no tiene signo, el resultado es un valor positivo muy alto. Eso significa que la verificación de desbordamiento nunca es cierta. Además, ->bytesused en realidad no funciona para este propósito porque no estamos escribiendo en "buf->mem + buf->bytesused". En cambio, las matemáticas para calcular el destino donde estamos escribiendo son un poco complicadas. Calcula el número de líneas completas ya escritas, multiplica por dos, omite una línea si es necesario para comenzar en una línea impar y agrega el desplazamiento a la línea. Para solucionar este desbordamiento del búfer, simplemente tome el destino real donde estamos escribiendo, si el desplazamiento ya está fuera de los límites imprima un error y regrese. De lo contrario, escriba hasta buf->bytes de longitud.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2024-06-18 CVE Reserved
- 2024-06-21 CVE Published
- 2024-06-22 EPSS Updated
- 2024-09-11 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://git.kernel.org/stable/c/9cb2173e6ea8f2948bd1367c93083a2500fcf08f | Vuln. Introduced |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 4.19.316 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 4.19.316" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 5.4.278 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 5.4.278" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 5.10.219 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 5.10.219" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 5.15.161 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 5.15.161" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 6.1.93 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 6.1.93" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 6.6.33 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 6.6.33" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 6.9.4 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 6.9.4" | en |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | >= 3.7 < 6.10 Search vendor "Linux" for product "Linux Kernel" and version " >= 3.7 < 6.10" | en |
Affected
| ||||||