漏洞标题
EEPROM: ee1004: 将I2C读取限制在I2C_SMBUS_BLOCK_MAX
漏洞描述信息
在Linux内核中，已解决以下漏洞：
eeprom: ee1004:限制I2C读取次数至I2C_SMBUS_BLOCK_MAX
提交effa453168a7（"i2c: i801:不要无声地修正无效传输大小"）揭示了ee1004_eeprom_read()没有正确限制一次读取的字节数。
特别是，i2c_smbus_read_i2c_block_data_or_emulated()将要读取的长度作为u8。如果在考虑偏移和页面边界后count等于256，则u8的转换会溢出。并且当用户空间尝试一次读取整个EEPROM时，这很常见。
为了解决此问题，将每次读取限制为I2C_SMBUS_BLOCK_MAX（32）字节，这已经是i2c_smbus_read_i2c_block_data_or_emulated()允许的最大长度。
CVSS信息
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
漏洞类别
跨界内存读
漏洞标题
eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
漏洞描述信息
In the Linux kernel, the following vulnerability has been resolved:
eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer
size") revealed that ee1004_eeprom_read() did not properly limit how
many bytes to read at once.
In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the
length to read as an u8. If count == 256 after taking into account the
offset and page boundary, the cast to u8 overflows. And this is common
when user space tries to read the entire EEPROM at once.
To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already
the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.
CVSS信息
N/A
漏洞类别
N/A
漏洞标题
Linux kernel 安全漏洞
漏洞描述信息
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel 存在安全漏洞，该漏洞源于eeprom模块中发现I2C读取限制问题。ee1004_eeprom_read函数没有正确限制一次读取的字节数。
CVSS信息
N/A
漏洞类别
其他