On Mon, Mar 21, 2022 at 08:40:06PM +0300, Denis Efremov wrote:
From: Jordy Zomer jordy@pwning.systems
It appears that there are some buffer overflows in EVT_TRANSACTION. This happens because the length parameters that are passed to memcpy come directly from skb->data and are not guarded in any way.
Link: https://lore.kernel.org/all/20220111164451.3232987-1-jordy@pwning.systems/#t Fixes: 26fc6c7f02cb ("NFC: st21nfca: Add HCI transaction event support") Cc: stable@vger.kernel.org # 4.0+ Signed-off-by: Jordy Zomer jordy@pwning.systems Reviewed-by: Krzysztof Kozlowski krzysztof.kozlowski@canonical.com Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Denis Efremov denis.e.efremov@oracle.com
CVE-2022-26490 was assigned to this patch. It looks like it's not in the stable trees yet. I only added Link:/Fixes:/Cc: stable... to the commit's message.
drivers/nfc/st21nfca/se.c | 10 ++++++++++ 1 file changed, 10 insertions(+)
What is the git commit id of this patch in Linus's tree?
And your "To:" line was corrupted, might want to check your email client :(
thanks,
greg k-h