Medium · published March 22, 2021
In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | < 4.4.263 | 4.4.263 |
| linux/linux_kernel | > 4.5, ≤ 4.9.263 | — |
| linux/linux_kernel | ≥ 4.10, < 4.14.227 | 4.14.227 |
| linux/linux_kernel | > 4.15, ≤ 4.19.183 | — |
| linux/linux_kernel | ≥ 4.20, < 5.4.108 | 5.4.108 |
| linux/linux_kernel | ≥ 5.5.0, < 5.10.26 | 5.10.26 |
| linux/linux_kernel | ≥ 5.11, < 5.11.9 | 5.11.9 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/fas\/aff_baseboard_management_controller | all versions | — |
| netapp/solidfire_baseboard_management_controller_firmware | all versions | — |