CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's hwmon subsystem, specifically in the adm1266 driver, where a 5-byte stack buffer is insufficient for handling responses from the SMBus, potentially leading to a buffer overflow if the returned block length exceeds 5 bytes. This overflow can result in memory corruption, which may allow an attacker to execute arbitrary code or crash the system. Linux kernel maintainers and developers working with hardware monitoring drivers should prioritize addressing this issue to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: hwmon: (pmbus/adm1266) widen blackbox-info buffer to I2C_SMBUS_BLOCK_MAX adm1266_nvmem_read_blackbox() declares a 5-byte stack buffer and passes it to i2c_smbus_read_block_data() to retrieve the 4-byte BLACKBOX_INFO response. i2c_smbus_read_block_data() does not honour caller buffer sizes -- it memcpy()s data.block[0] bytes from the SMBus transaction (where data.block[0] is the length byte returned by the slave device, up to I2C_SMBUS_BLOCK_MAX = 32): memcpy(values, &data.block[1], data.block[0]); If the device returns any block length above 5, the call overflows the caller's 5-byte stack buffer before the post-call if (ret != 4) return -EIO; check has a chance to reject the response. Widen the local buffer to I2C_SMBUS_BLOCK_MAX so the helper has room for any well-formed SMBus block response, matching the convention used by the other i2c_smbus_read_block_data() callers in this driver.
Related CVEs
Other vulnerabilities affecting the same vendor(s)