| Message ID | 20240624225020.39755-1-bethany.jamison@canonical.com |
|---|---|
| Headers | show |
| Series | CVE-2024-35992 | expand |
On Mon, Jun 24, 2024 at 05:50:19PM -0500, Bethany Jamison wrote: > [Impact] > > phy: marvell: a3700-comphy: Fix out of bounds read > > There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr' > every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'. > > Make sure 'gbe_phy_init[addr]' is used when all elements of > 'gbe_phy_init_fix' array are handled. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > [Fix] > > Noble: Clean cherry-pick from linux-6.8.y > Jammy: not affected > Focal: not affected > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test Case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects those who use the driver for the Marvell > physical layer, an issue with this fix would be visible to > the user via unexpected system behavior or a system crash. > > Mikhail Kobuk (1): > phy: marvell: a3700-comphy: Fix out of bounds read > > drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > -- > 2.34.1 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team This fix is also part of upstream stable update v6.8.9: https://launchpad.net/bugs/2070337 Acked-by: Manuel Diewald <manuel.diewald@canonical.com>
On 24/06/24 05:50pm, Bethany Jamison wrote: > [Impact] > > phy: marvell: a3700-comphy: Fix out of bounds read > > There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr' > every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'. > > Make sure 'gbe_phy_init[addr]' is used when all elements of > 'gbe_phy_init_fix' array are handled. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > [Fix] > > Noble: Clean cherry-pick from linux-6.8.y > Jammy: not affected > Focal: not affected > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test Case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects those who use the driver for the Marvell > physical layer, an issue with this fix would be visible to > the user via unexpected system behavior or a system crash. > > Mikhail Kobuk (1): > phy: marvell: a3700-comphy: Fix out of bounds read > > drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) Acked-by: Andrei Gherzan <andrei.gherzan@canonical.com>
On 25.06.24 00:50, Bethany Jamison wrote: > [Impact] > > phy: marvell: a3700-comphy: Fix out of bounds read > > There is an out of bounds read access of 'gbe_phy_init_fix[fix_idx].addr' > every iteration after 'fix_idx' reaches 'ARRAY_SIZE(gbe_phy_init_fix)'. > > Make sure 'gbe_phy_init[addr]' is used when all elements of > 'gbe_phy_init_fix' array are handled. > > Found by Linux Verification Center (linuxtesting.org) with SVACE. > > [Fix] > > Noble: Clean cherry-pick from linux-6.8.y > Jammy: not affected > Focal: not affected > Bionic: not affected > Xenial: not affected > Trusty: not affected > > [Test Case] > > Compile and boot tested > > [Where problems could occur] > > This fix affects those who use the driver for the Marvell > physical layer, an issue with this fix would be visible to > the user via unexpected system behavior or a system crash. > > Mikhail Kobuk (1): > phy: marvell: a3700-comphy: Fix out of bounds read > > drivers/phy/marvell/phy-mvebu-a3700-comphy.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > Applied to noble:linux/master-next. Thanks. -Stefan