From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3612216E21 for ; Wed, 26 Feb 2025 02:14:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536069; cv=none; b=dKjn2M22QKlc8eQ2L2ThFhasoCZLs6pAbISP2FgotPOX7ZDTW/TUYhW+9qkvzAD7XTi40PnVUlWo5HpBRON4eXD0mi7t9FY09hePQRjrey1L1PMcxiiFbxXc0iBmyX3hS/roukE6wSWE3+vn2oxp2Xbxq97JNAIoS5IkM9FJJaQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536069; c=relaxed/simple; bh=SZeeVt+JaceuSbuv5AzuWiSBlnnjdtxLgXUizuseATw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=UWrbc5kW2blRTx5sF3MxLbtoxFuMwJNCNUX4+XcvigqfiYokaeMfACqQ/BBUNGU3CeGHccvSnrCGGkzLPqwwyGSECJx5n4Zs4KGr4xTe5Qm6/b3054fEKPYwM3SsgYbyXUVhjgMy3eSleOSAMCPZX79jw6wDSxq1IgnNQtMKzwk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=hastkKMd; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="hastkKMd" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 74969C4CEDD; Wed, 26 Feb 2025 02:14:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536069; bh=SZeeVt+JaceuSbuv5AzuWiSBlnnjdtxLgXUizuseATw=; h=From:To:Cc:Subject:Date:Reply-to:From; b=hastkKMdZCpJsBltMNpVzusqQNXSm5IpkPOH0AaX4zM3ZNPLFNl1Iz8Vz52oa66xT r4e+9c1Kc4y3NxaKRR7wW8Jg45AftYdPbF4YgYg7qGogIPLLLvnz8LWlsXT4eUesRh 1CwmzzqV3Tdgajxxx9aiw/1zcWTXqpmEsuKusalY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49451: firmware: arm_scmi: Fix list protocols enumeration in the base protocol Date: Wed, 26 Feb 2025 03:12:05 +0100 Message-ID: <2025022659-CVE-2022-49451-5d2f@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3334; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=SZeeVt+JaceuSbuv5AzuWiSBlnnjdtxLgXUizuseATw=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7yr9P0kl93HzRKnJP7JcHSfHaLtU/3syveB6zfV/37 b6XO8JYO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAifrIMC/pKdx9aPEvF7M5b 8RJGv3kaeQ6v+hkW7PB5dfasUdFcZf4dfS6569/y9irdBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Fix list protocols enumeration in the base protocol While enumerating protocols implemented by the SCMI platform using BASE_DISCOVER_LIST_PROTOCOLS, the number of returned protocols is currently validated in an improper way since the check employs a sum between unsigned integers that could overflow and cause the check itself to be silently bypassed if the returned value 'loop_num_ret' is big enough. Fix the validation avoiding the addition. The Linux kernel CVE team has assigned CVE-2022-49451 to this issue. Affected and fixed versions =========================== Issue introduced in 4.17 with commit b6f20ff8bd94ad34032804a60bab5ee56752007e and fixed in 4.19.247 with commit 444a2d27fe9867d0da4b28fc45b793f32e099ab8 Issue introduced in 4.17 with commit b6f20ff8bd94ad34032804a60bab5ee56752007e and fixed in 5.4.198 with commit b0e4bafac8963c2d85ee18d3d01f393735acceec Issue introduced in 4.17 with commit b6f20ff8bd94ad34032804a60bab5ee56752007e and fixed in 5.10.121 with commit 1052f22e127d0c34c3387bb389424ba1c61491ff Issue introduced in 4.17 with commit b6f20ff8bd94ad34032804a60bab5ee56752007e and fixed in 5.15.46 with commit 98342148a8cd242855d7e257f298c966c96dba9f Issue introduced in 4.17 with commit b6f20ff8bd94ad34032804a60bab5ee56752007e and fixed in 5.17.14 with commit 6e7978695f4a6cbd83616b5a702b77fa2087b247 Issue introduced in 4.17 with commit b6f20ff8bd94ad34032804a60bab5ee56752007e and fixed in 5.18.3 with commit 2ccfcd7a09c826516edcfe464b05071961aada3f Issue introduced in 4.17 with commit b6f20ff8bd94ad34032804a60bab5ee56752007e and fixed in 5.19 with commit 8009120e0354a67068e920eb10dce532391361d0 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49451 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/firmware/arm_scmi/base.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/444a2d27fe9867d0da4b28fc45b793f32e099ab8 https://git.kernel.org/stable/c/b0e4bafac8963c2d85ee18d3d01f393735acceec https://git.kernel.org/stable/c/1052f22e127d0c34c3387bb389424ba1c61491ff https://git.kernel.org/stable/c/98342148a8cd242855d7e257f298c966c96dba9f https://git.kernel.org/stable/c/6e7978695f4a6cbd83616b5a702b77fa2087b247 https://git.kernel.org/stable/c/2ccfcd7a09c826516edcfe464b05071961aada3f https://git.kernel.org/stable/c/8009120e0354a67068e920eb10dce532391361d0