CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of firmware sections in the panthor driver, where a lack of validation for the data size can lead to a heap buffer overflow. This flaw could allow an attacker to execute arbitrary code or cause a denial of service by manipulating firmware data sizes, potentially leading to out-of-bounds memory access. Organizations using affected Linux kernel versions, particularly those relying on the panthor driver for graphics or hardware acceleration, should prioritize applying the relevant patches to mitigate this risk.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: drm/panthor: reject firmware sections with oversized data In panthor_fw_load_section_entry(), the data size to copy is calculated without validating it against the allocated section_size: section->data.size = hdr.data.end - hdr.data.start; If a crafted firmware sets data.size larger than the allocated memory, this could cause a heap buffer overflow in panthor_fw_init_section_mem() memcpy(section->mem->kmap, section->data.buf, section->data.size); Additionally, if the section->data.size exceeds the BO size, could this memset underflow the size calculation, leading to a massive out-of-bounds zeroing of kernel memory? memset(section->mem->kmap + section->data.size, 0, panthor_kernel_bo_size(section->mem) - section->data.size); Reject section entries whose initial data is larger than the section size.