In the Linux kernel, the following vulnerability has been resolved:
usb: typec: ucsi: ccg: reject firmware images without a ':' record header
do_flash() locates the first .cyacd record with
p = strnchr(fw->data, fw->size, ':');
while (p < eof) {
s = strnchr(p + 1, eof - p - 1, ':');
...
}
If the firmware image contains no ':' byte, strnchr() returns NULL.
NULL compares less than the valid kernel pointer eof, so the loop body
runs and strnchr() is called with p + 1 == (void *)1 and a length of
roughly (unsigned long)eof, causing a wonderful crash.
The not_signed_fw fallthrough earlier in do_flash() and the chip-state
branches in ccg_fw_update_needed() allow an unsigned blob to reach this
loop, so a root user who can place a crafted file under /lib/firmware
and write the do_flash sysfs attribute can trigger the oops.
Bail out with -EINVAL when the initial strnchr() returns NULL.
from 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 before b41dfc033fe594e152648050e95b9489cd53e9e3; 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 builds before 2f395ca1263bd181995eb829f5943a83a20db213; from 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 before 6526f8684f72391138353642af908803ba70795e; 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 builds before 3f432b8203066c26770fe6ea591361f10021dd6b; from 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 before c4ee519b06389e59ba2d6aa722fcc4a02a8bbcbb; from 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 before a38ed87818b2419090fb1a6338ddce6842b65dfa; from 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 before c8460de584fe5415d212cfdd127d4db90835a450; from 5c9ae5a87573d38cfc4c740aafda2fa6ce06e401 before d7486952bf74e546ee3748fb14b2d07881fa6273
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
