In the Linux kernel, the following vulnerability has been resolved:
Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem
When a configuration file provides an object size that is larger than the
driver's known mxt_obj_size(object), the driver intends to discard the
extra bytes.
The loop iterates using for (i = 0; i < size; i++). Inside the loop, the
condition to skip processing extra bytes is:
if (i > mxt_obj_size(object))
continue;
Since i is a 0-based index, the valid indices for the object are 0 through
mxt_obj_size(object) - 1.
When i == mxt_obj_size(object), the condition evaluates to false, and the
code processes the byte instead of discarding it.
This causes the code to calculate byte_offset = reg + i - cfg->start_ofs
and writes the byte there, overwriting exactly one byte of the adjacent
instance or object.
Update the boundary check to skip extra bytes correctly by using >=.
from 50a77c658b80e7e3303e3bcec195b30e2b62d513 before 862a1a32b5190241fce7a7d20229539a3926f31e; 50a77c658b80e7e3303e3bcec195b30e2b62d513 builds before 5c3681c3abc35cfac6b702251382312c60d96bc2; from 50a77c658b80e7e3303e3bcec195b30e2b62d513 before 1017e1c6c6c49cccbcda9bbcfa49e50b0b6dad39; from 50a77c658b80e7e3303e3bcec195b30e2b62d513 before e9b62996ba537774f68fecfd7eecb5aec1713952; from 50a77c658b80e7e3303e3bcec195b30e2b62d513 before ae92e334544263a02d9f99e18385e718c44392c9; 50a77c658b80e7e3303e3bcec195b30e2b62d513 builds before 7f95f4792c0dc767fcb8e405391e779ab419d55a; 50a77c658b80e7e3303e3bcec195b30e2b62d513 builds before 6c6b989b4ebf22b086fdfcac2163b5cb55e34d8f; from 50a77c658b80e7e3303e3bcec195b30e2b62d513 before baa0210fb6a9dc3882509a9411b6d284d88fe30e
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
