In the Linux kernel, the following vulnerability has been resolved:
acpi: nfit: vmalloc-out-of-bounds Read in acpinfitctl
Fix an issue detected by syzbot with KASAN:
BUG: KASAN: vmalloc-out-of-bounds in cmdtofunc drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpinfitctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459
The issue occurs in cmdtofunc when the callpkg->ndreserved2 array is accessed without verifying that callpkg points to a buffer that is appropriately sized as a struct ndcmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space.
To address this, a check was added in acpinfitctl() to ensure that buf is not NULL and that buflen is less than sizeof(*callpkg) before accessing it. This ensures safe access to the members of callpkg, including the ndreserved2 array.
[
{
"deprecated": false,
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
},
"digest": {
"length": 4967.0,
"function_hash": "17874501650637376069814021772107472348"
},
"id": "CVE-2024-56662-17d10729",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/acpi/nfit/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"id": "CVE-2024-56662-2377d52f",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@212846fafb753a48e869e2a342fc1e24048da771",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/acpi/nfit/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"id": "CVE-2024-56662-2d4d76d7",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
},
"digest": {
"length": 4967.0,
"function_hash": "17874501650637376069814021772107472348"
},
"id": "CVE-2024-56662-82aa2d1e",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@212846fafb753a48e869e2a342fc1e24048da771",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/acpi/nfit/core.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"id": "CVE-2024-56662-a4d613f6",
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbdb3307f609ec4dc9558770f464ede01fe52aed",
"signature_version": "v1"
},
{
"deprecated": false,
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
},
"digest": {
"length": 4967.0,
"function_hash": "17874501650637376069814021772107472348"
},
"id": "CVE-2024-56662-aa153da7",
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbdb3307f609ec4dc9558770f464ede01fe52aed",
"signature_version": "v1"
}
]