In the Linux kernel, the following vulnerability has been resolved:
acpi: nfit: vmalloc-out-of-bounds Read in acpinfitctl
Fix an issue detected by syzbot with KASAN:
BUG: KASAN: vmalloc-out-of-bounds in cmdtofunc drivers/acpi/nfit/ core.c:416 [inline] BUG: KASAN: vmalloc-out-of-bounds in acpinfitctl+0x20e8/0x24a0 drivers/acpi/nfit/core.c:459
The issue occurs in cmdtofunc when the callpkg->ndreserved2 array is accessed without verifying that callpkg points to a buffer that is appropriately sized as a struct ndcmd_pkg. This can lead to out-of-bounds access and undefined behavior if the buffer does not have sufficient space.
To address this, a check was added in acpinfitctl() to ensure that buf is not NULL and that buflen is less than sizeof(*callpkg) before accessing it. This ensures safe access to the members of callpkg, including the ndreserved2 array.
{
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56662.json",
"cna_assigner": "Linux"
}[
{
"id": "CVE-2024-56662-17d10729",
"signature_version": "v1",
"digest": {
"function_hash": "17874501650637376069814021772107472348",
"length": 4967.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0",
"signature_type": "Function",
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
}
},
{
"id": "CVE-2024-56662-1db70434",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@265e98f72bac6c41a4492d3e30a8e5fd22fe0779",
"signature_type": "Line",
"target": {
"file": "drivers/acpi/nfit/core.c"
}
},
{
"id": "CVE-2024-56662-2d4d76d7",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@143f723e9eb4f0302ffb7adfdc7ef77eab3f68e0",
"signature_type": "Line",
"target": {
"file": "drivers/acpi/nfit/core.c"
}
},
{
"id": "CVE-2024-56662-47192579",
"signature_version": "v1",
"digest": {
"function_hash": "17874501650637376069814021772107472348",
"length": 4967.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d",
"signature_type": "Function",
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
}
},
{
"id": "CVE-2024-56662-4cc2b9a9",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616aa5f3c86e0479bcbb81e41c08c43ff32af637",
"signature_type": "Line",
"target": {
"file": "drivers/acpi/nfit/core.c"
}
},
{
"id": "CVE-2024-56662-4e29efed",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e08dc2dc3c3f7938df0e4476fe3e6fdec5583c1d",
"signature_type": "Line",
"target": {
"file": "drivers/acpi/nfit/core.c"
}
},
{
"id": "CVE-2024-56662-5d6796eb",
"signature_version": "v1",
"digest": {
"function_hash": "17874501650637376069814021772107472348",
"length": 4967.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@265e98f72bac6c41a4492d3e30a8e5fd22fe0779",
"signature_type": "Function",
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
}
},
{
"id": "CVE-2024-56662-a4d613f6",
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"166113646474136389695049983800833546556",
"158161211008092860526398657467602180420",
"306933491437809756268828988704410891700",
"145675045935404848869943938602649386396",
"243079483735546575064441783223963073193"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbdb3307f609ec4dc9558770f464ede01fe52aed",
"signature_type": "Line",
"target": {
"file": "drivers/acpi/nfit/core.c"
}
},
{
"id": "CVE-2024-56662-aa153da7",
"signature_version": "v1",
"digest": {
"function_hash": "17874501650637376069814021772107472348",
"length": 4967.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bbdb3307f609ec4dc9558770f464ede01fe52aed",
"signature_type": "Function",
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
}
},
{
"id": "CVE-2024-56662-b3012a96",
"signature_version": "v1",
"digest": {
"function_hash": "17874501650637376069814021772107472348",
"length": 4967.0
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@616aa5f3c86e0479bcbb81e41c08c43ff32af637",
"signature_type": "Function",
"target": {
"file": "drivers/acpi/nfit/core.c",
"function": "acpi_nfit_ctl"
}
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56662.json"