From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-arm-msm-owner@vger.kernel.org>
X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on
	aws-us-west-2-korg-lkml-1.web.codeaurora.org
Received: from vger.kernel.org (vger.kernel.org [23.128.96.18])
	by smtp.lore.kernel.org (Postfix) with ESMTP id BE419C77B71
	for <linux-arm-msm@archiver.kernel.org>; Tue, 18 Apr 2023 07:47:34 +0000 (UTC)
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S231183AbjDRHrd (ORCPT
        <rfc822;linux-arm-msm@archiver.kernel.org>);
        Tue, 18 Apr 2023 03:47:33 -0400
Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54980 "EHLO
        lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S230244AbjDRHr2 (ORCPT
        <rfc822;linux-arm-msm@vger.kernel.org>);
        Tue, 18 Apr 2023 03:47:28 -0400
Received: from smtp-out1.suse.de (smtp-out1.suse.de [IPv6:2001:67c:2178:6::1c])
        by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDE2E7DB3;
        Tue, 18 Apr 2023 00:47:04 -0700 (PDT)
Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74])
        (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
         key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512)
        (No client certificate requested)
        by smtp-out1.suse.de (Postfix) with ESMTPS id 6A42221A15;
        Tue, 18 Apr 2023 07:47:03 +0000 (UTC)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.de; s=susede2_rsa;
        t=1681804023; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:
         mime-version:mime-version:content-type:content-type:
         in-reply-to:in-reply-to:references:references;
        bh=eMC66crlZNa13iNMbBSheE0yhYEzTw0dIUu1wy+r0sc=;
        b=UyFUJMBqBgacdQ/J1yd44TsnZ9DNQwBuF5Pi17LBhF/i/GinFUz7svvOiO/J9tNxNBeC+A
        XI5YF/TytBzgDeQvtQiwam/OEndilDqzi6pcrB4H1HFTy/3W9tRdqQrjf9BGDtOsBzd0b3
        m7aNUQxIB+zWhY5gu2/C0hLBocu6PTc=
DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=suse.de;
        s=susede2_ed25519; t=1681804023;
        h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc:
         mime-version:mime-version:content-type:content-type:
         in-reply-to:in-reply-to:references:references;
        bh=eMC66crlZNa13iNMbBSheE0yhYEzTw0dIUu1wy+r0sc=;
        b=hU4Djo3l//yID6wYySd0HqVlLgS9i78pMRPdZw3eTw1rL9sHmDrSKg8W6xIiIxJFp0QJII
        wtSBWrECgKg+nlBw==
Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74])
        (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
         key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512)
        (No client certificate requested)
        by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 4E7C4139CC;
        Tue, 18 Apr 2023 07:47:03 +0000 (UTC)
Received: from dovecot-director2.suse.de ([192.168.254.65])
        by imap2.suse-dmz.suse.de with ESMTPSA
        id VXpiEvdKPmQZbAAAMHmgww
        (envelope-from <tiwai@suse.de>); Tue, 18 Apr 2023 07:47:03 +0000
Date:   Tue, 18 Apr 2023 09:47:02 +0200
Message-ID: <87ttxd4op5.wl-tiwai@suse.de>
From:   Takashi Iwai <tiwai@suse.de>
To:     Andy Gross <agross@kernel.org>,
        Bjorn Andersson <andersson@kernel.org>
Cc:     linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: Missing qcom/mdt_loader.c fix for CVE-2022-40540?
In-Reply-To: <87ileq5ktl.wl-tiwai@suse.de>
References: <87ileq5ktl.wl-tiwai@suse.de>
User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/27.2 Mule/6.0
MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue")
Content-Type: text/plain; charset=US-ASCII
Precedence: bulk
List-ID: <linux-arm-msm.vger.kernel.org>
X-Mailing-List: linux-arm-msm@vger.kernel.org

On Fri, 24 Mar 2023 14:40:38 +0100,
Takashi Iwai wrote:
> 
> Hi,
> 
> I was asked about the handling for CVE-2022-40540 [*] on SUSE kernels,
> and through a quick glance, the upstream code still misses the fix.
> Namely, the downstream fix for the integer overflow check of the
> firmware size below:
>   https://git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/dae3214cd3495e5c4b37537cacf665d2cdeaea24
> ... can be applied to the current upstream code (as of 6.3-rc3) as far
> as I understand.
> 
> Could you guys check it and apply the fix if really needed?

Any news on this?  This security issue seems still present in the
latest upstream and linux-next.


thanks,

Takashi

> 
> 
> Thanks!
> 
> Takashi
> 
> [*]
>   http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40540
>   https://bugzilla.redhat.com/show_bug.cgi?id=2180513
>   https://www.cve.org/CVERecord?id=CVE-2022-40540
>   https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin