In the Linux kernel, the following vulnerability has been resolved:
software node: Fix software_node_get_reference_args() with index -1
The bounds check for the index passed to
software_node_get_reference_args() was failing when passed UINT_MAX,
this in turn would lead to an out of bound access in the property
array. Fix the bound check to also cover the UINT_MAX case.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
High
Difficult to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/0631384eadebc66d92d2dd72d57a0263c3877bee
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/231bbc04c58f115a505bf3b668ec69ef40a1773b
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/4ebf96d5f834aba7f6d0397db4c421f6078171b9
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/6cde06887487b4febd14658c9a246616abcc0097
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/849076df15129e47dd8db751fa18489419ffea56
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b2fa4e8c7e4a33e02e6aaa8f6df72f84cf4aed75
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ba3dedcf3bd47017307595a7e54924198f018246
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/df5466412b362db7adfa78e3e092fe07ac6769a4
416baaa9-dc9f-4396-8d5f-8c081fb06d67