linux-kernel - [PATCH] platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <39973642a4f24295b4a8fad9109c5b08@kaspersky.com>
Date: Wed, 14 May 2025 12:12:55 +0000
From: Vladimir Moskovkin <Vladimir.Moskovkin@...persky.com>
To: Prasanth Ksr <prasanth.ksr@...l.com>
CC: Hans de Goede <hdegoede@...hat.com>, Ilpo Järvinen
	<ilpo.jarvinen@...ux.intel.com>, Mario Limonciello
	<mario.limonciello@...l.com>, Divya Bharathi <divya.bharathi@...l.com>,
	"Dell.Client.Kernel@...l.com" <Dell.Client.Kernel@...l.com>,
	"platform-driver-x86@...r.kernel.org" <platform-driver-x86@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"stable@...r.kernel.org" <stable@...r.kernel.org>,
	"lvc-project@...uxtesting.org" <lvc-project@...uxtesting.org>
Subject: [PATCH] platform/x86: dell-wmi-sysman: Avoid buffer overflow in
 current_password_store()

If the 'buf' array received from the user contains an empty string, the
'length' variable will be zero. Accessing the 'buf' array element with
index 'length - 1' will result in a buffer overflow.

Add a check for an empty string.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Cc: stable@...r.kernel.org
Signed-off-by: Vladimir Moskovkin <Vladimir.Moskovkin@...persky.com>
---
 drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c
index 230e6ee96636..d8f1bf5e58a0 100644
--- a/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c
+++ b/drivers/platform/x86/dell/dell-wmi-sysman/passobj-attributes.c
@@ -45,7 +45,7 @@ static ssize_t current_password_store(struct kobject *kobj,
 	int length;
 
 	length = strlen(buf);
-	if (buf[length-1] == '\n')
+	if (length && buf[length - 1] == '\n')
 		length--;
 
 	/* firmware does verifiation of min/max password length,
-- 
2.25.1