2023-03-24 13:49:11

by Takashi Iwai

Subject: Missing qcom/mdt_loader.c fix for CVE-2022-40540?

Hi,

I was asked about the handling for CVE-2022-40540 [*] on SUSE kernels,
and through a quick glance, the upstream code still misses the fix.
Namely, the downstream fix for the integer overflow check of the
firmware size below:
https://git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/dae3214cd3495e5c4b37537cacf665d2cdeaea24
... can be applied to the current upstream code (as of 6.3-rc3) as far
as I understand.

Could you guys check it and apply the fix if really needed?


Thanks!

Takashi

[*]
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40540
https://bugzilla.redhat.com/show_bug.cgi?id=2180513
https://www.cve.org/CVERecord?id=CVE-2022-40540
https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin

2023-04-18 07:48:49

by Takashi Iwai

Subject: Re: Missing qcom/mdt_loader.c fix for CVE-2022-40540?

On Fri, 24 Mar 2023 14:40:38 +0100,
Takashi Iwai wrote:
>
> Hi,
>
> I was asked about the handling for CVE-2022-40540 [*] on SUSE kernels,
> and through a quick glance, the upstream code still misses the fix.
> Namely, the downstream fix for the integer overflow check of the
> firmware size below:
> https://git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/dae3214cd3495e5c4b37537cacf665d2cdeaea24
> ... can be applied to the current upstream code (as of 6.3-rc3) as far
> as I understand.
>
> Could you guys check it and apply the fix if really needed?

Any news on this? This security issue seems still present in the
latest upstream and linux-next.


thanks,

Takashi

>
>
> Thanks!
>
> Takashi
>
> [*]
> http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40540
> https://bugzilla.redhat.com/show_bug.cgi?id=2180513
> https://www.cve.org/CVERecord?id=CVE-2022-40540
> https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin