An array overflow was discovered in mt76addfragment in drivers/net/wireless/mediatek/mt76/dma.c in the Linux kernel before 5.5.10, aka CID-b102f0c522cf. An oversized packet with too many rx fragments can corrupt memory of adjacent pages.
[
{
"id": "CVE-2020-12465-a1bb7403",
"signature_version": "v1",
"digest": {
"function_hash": "170109692570042019046941298354455236707",
"length": 442.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b102f0c522cf668c8382c56a4f771b37d011cda2",
"signature_type": "Function",
"target": {
"file": "drivers/net/wireless/mediatek/mt76/dma.c",
"function": "mt76_add_fragment"
}
},
{
"id": "CVE-2020-12465-d6249720",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"167093705064208035048871073676377765924",
"44739582346620383591066242201582623848",
"222888488607261550187673711871288201101",
"116910966395288031017467395735021606643",
"46165607570066975091103983352252545296",
"182904090007021940618217289910755273433",
"215622192527084505583885183038753319097"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@b102f0c522cf668c8382c56a4f771b37d011cda2",
"signature_type": "Line",
"target": {
"file": "drivers/net/wireless/mediatek/mt76/dma.c"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-12465.json"