Bug 1757372 (CVE-2016-10907)

Summary:	CVE-2016-10907 kernel: out of bounds write in ad5755_parse_dt in drivers/iio/dac/ad5755.c
Product:	[Other] Security Response	Reporter:	msiddiqu
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bdettelb, bhu, blc, brdeoliv, bskeggs, dhoward, dominik.mierzejewski, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, john.j5live, jonathan, josef, jross, jschorr, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mjg59, mlangsdo, nmurray, plougher, rkeshri, rt-maint, rvrbovsk, steved, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An out-of-bounds flaw was found in the Industrial I/O Subsystem of the Linux kernel. A comparison for devnr limits is exceeded by one, where the current implementation allowed 0 to AD5755_NUM_CHANNELS, while the actual limit should have been till 'AD5755_NUM_CHANNELS - 1'. This could lead to an out of bounds write to pdata->dac[devnr]. The highest risk from this vulnerability is system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-02-17 14:09:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1757373

Description msiddiqu 2019-10-01 10:41:29 UTC

A vulnerability was found in ad5755_parse_dt in drivers/iio/dac/ad5755.c  in Linux Industrial I/O Subsystem subsystem. Here a comparison for devnr limits was exceeding by one, were the current implementation allowed 0 to AD5755_NUM_CHANNELS, while the actual limit should have been till 'AD5755_NUM_CHANNELS - 1', and this can cause an out of bounds write to pdata->dac[devnr].


Upstream patch: 

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d47964bfd471f0dd4c89f28556aec68bffa0020

References:  

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.6

Comment 1 Rohit Keshri 2020-02-17 10:39:24 UTC

Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 3 Product Security DevOps Team 2020-02-17 14:09:42 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2016-10907