Bug 1757372 (CVE-2016-10907) - CVE-2016-10907 kernel: out of bounds write in ad5755_parse_dt in drivers/iio/dac/ad5755.c
Summary: CVE-2016-10907 kernel: out of bounds write in ad5755_parse_dt in drivers/iio/...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2016-10907
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1757373
TreeView+ depends on / blocked
 
Reported: 2019-10-01 10:41 UTC by msiddiqu
Modified: 2021-02-16 21:20 UTC (History)
48 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds flaw was found in the Industrial I/O Subsystem of the Linux kernel. A comparison for devnr limits is exceeded by one, where the current implementation allowed 0 to AD5755_NUM_CHANNELS, while the actual limit should have been till 'AD5755_NUM_CHANNELS - 1'. This could lead to an out of bounds write to pdata->dac[devnr]. The highest risk from this vulnerability is system availability.
Clone Of:
Environment:
Last Closed: 2020-02-17 14:09:42 UTC
Embargoed:

Attachments (Terms of Use)

Description msiddiqu 2019-10-01 10:41:29 UTC 
A vulnerability was found in ad5755_parse_dt in drivers/iio/dac/ad5755.c  in Linux Industrial I/O Subsystem subsystem. Here a comparison for devnr limits was exceeding by one, were the current implementation allowed 0 to AD5755_NUM_CHANNELS, while the actual limit should have been till 'AD5755_NUM_CHANNELS - 1', and this can cause an out of bounds write to pdata->dac[devnr].


Upstream patch: 

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9d47964bfd471f0dd4c89f28556aec68bffa0020

References:  

https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.8.6
Comment 1 Rohit Keshri 2020-02-17 10:39:24 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 3 Product Security DevOps Team 2020-02-17 14:09:42 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2016-10907
Note You need to log in before you can comment on or make changes to this bug.