kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/platform
History
Junrui Luo db4c26adf7 platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing 
[ Upstream commit e44c42c830 ]

The hp_populate_*_elements_from_package() functions in the hp-bioscfg
driver contain out-of-bounds array access vulnerabilities.

These functions parse ACPI packages into internal data structures using
a for loop with index variable 'elem' that iterates through
enum_obj/integer_obj/order_obj/password_obj/string_obj arrays.

When processing multi-element fields like PREREQUISITES and
ENUM_POSSIBLE_VALUES, these functions read multiple consecutive array
elements using expressions like 'enum_obj[elem + reqs]' and
'enum_obj[elem + pos_values]' within nested loops.

The bug is that the bounds check only validated elem, but did not consider
the additional offset when accessing elem + reqs or elem + pos_values.

The fix changes the bounds check to validate the actual accessed index.

Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Reported-by: Junrui Luo <moonafterrain@outlook.com>
Fixes: e6c7b3e155 ("platform/x86: hp-bioscfg: string-attributes")
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Link: https://patch.msgid.link/SYBPR01MB788173D7DD4EA2CB6383683DAFB0A@SYBPR01MB7881.ausprd01.prod.outlook.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-08 10:14:35 +01:00
..
arm64 move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
chrome platform/chrome: cros_ec_ishtp: Fix UAF after unbinding driver 2026-01-08 10:14:21 +01:00
cznic platform: cznic: CZNIC_PLATFORMS should depend on ARCH_MVEBU 2025-02-27 04:30:20 -08:00
goldfish platform/goldfish: goldfish_pipe: add missing MODULE_DESCRIPTION() macro 2024-07-03 16:40:46 +02:00
loongarch platform/loongarch: laptop: Add backlight power control support 2025-06-27 11:11:37 +01:00
mellanox platform/mellanox: mlxbf-pmc: Remove trailing whitespaces from event names 2026-01-08 10:14:33 +01:00
mips platform: mips: cpu_hwmon: Disable driver on unsupported hardware 2024-06-21 10:22:10 +02:00
olpc platform-drivers-x86 for v6.12-1 2024-09-19 09:16:04 +02:00
surface move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
x86 platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing 2026-01-08 10:14:35 +01:00
Kconfig platform: cznic: Add preliminary support for Turris Omnia MCU 2024-07-01 15:46:36 +02:00
Makefile platform-drivers-x86 for v6.11-1 2024-07-17 17:05:21 -07:00