| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 19 Jan 2023 15:21:13 +0100 From: Armin Wolf <W_Armin@....de> To: rafael@...nel.org, lenb@...nel.org Cc: linux-acpi@...r.kernel.org, linux-kernel@...r.kernel.org Subject: [PATCH v2 0/2] ACPI: battery: Fix various string handling issues On my Dell Inspiron 3505, the battery model name was displayed differently than when running Windows. While i first suspected an ACPI issue, it turned out that the real reason was the ACPI battery driver failing to handle strings larger than 32 bytes. This caused the model name of the battery (35 bytes long, hex string) to miss proper NUL-termination, resulting in a buffer overread later. Luckily, a valid string was stored right after the now invalid string, appending only the battery serial number to the original model name. The first patch fixes a potential buffer overread then handling buffers, while the second patch finally increases the maximum string length to avoid truncating such larger strings. The patch series was tested on a Dell Inspiron 3505 and appears to work properly. --- Changes in v2: - Drop first patch since it was already applied - combine the second and third patch - do not replace 0 with '\0' - spell ACPI in capitals - rework the buffer length hdanling Armin Wolf (2): ACPI: battery: Fix buffer overread if not NUL-terminated ACPI: battery: Increase maximum string length drivers/acpi/battery.c | 35 +++++++++++++++++++++++------------ 1 file changed, 23 insertions(+), 12 deletions(-) -- 2.30.2
Powered by blists - more mailing lists