In the Linux kernel, the following vulnerability has been resolved:
wifi: carl9170: re-fix fortified-memset warning
The carl9170_tx_release() function sometimes triggers a fortified-memset
warning in my randconfig builds:
In file included from include/linux/string.h:254,
from drivers/net/wireless/ath/carl9170/tx.c:40:
In function ‘fortify_memset_chk’,
inlined from ‘carl9170_tx_release’ at drivers/net/wireless/ath/carl9170/tx.c:283:2,
inlined from ‘kref_put’ at include/linux/kref.h:65:3,
inlined from ‘carl9170_tx_put_skb’ at drivers/net/wireless/ath/carl9170/tx.c:342:9:
include/linux/fortify-string.h:493:25: error: call to ‘__write_overflow_field’ declared with attribute warning: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Werror=attribute-warning]
493 | __write_overflow_field(p_size_field, size);
Kees previously tried to avoid this by using memset_after(), but it seems
this does not fully address the problem. I noticed that the memset_after()
here is done on a different part of the union (status) than the original
cast was from (rate_driver_data), which may confuse the compiler.
Unfortunately, the memset_after() trick does not work on driver_rates[]
because that is part of an anonymous struct, and I could not get
struct_group() to do this either. Using two separate memset() calls
on the two members does address the warning though.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "13857683126e",
"versionType": "git"
},
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "875864670982",
"versionType": "git"
},
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "0c38c9c460bb",
"versionType": "git"
},
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "042a39bb8e08",
"versionType": "git"
},
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "066afafc10c9",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/wireless/ath/carl9170/tx.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.17"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "6.1.93",
"versionType": "custom",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.33",
"versionType": "custom",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.8.12",
"versionType": "custom",
"lessThanOrEqual": "6.8.*"
},
{
"status": "unaffected",
"version": "6.9.3",
"versionType": "custom",
"lessThanOrEqual": "6.9.*"
},
{
"status": "unaffected",
"version": "6.10",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/wireless/ath/carl9170/tx.c"
],
"defaultStatus": "affected"
}
]
[
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "13857683126e",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "875864670982",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "0c38c9c460bb",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "042a39bb8e08",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "fb5f6a0e8063",
"lessThan": "066afafc10c9",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "affected",
"version": "5.17"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "0",
"lessThan": "5.17",
"versionType": "custom"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.1.93",
"versionType": "custom",
"lessThanOrEqual": "6.2"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.6.33",
"versionType": "custom",
"lessThanOrEqual": "6.7"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.8.12",
"versionType": "custom",
"lessThanOrEqual": "6.9"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.9.3 t",
"versionType": "custom",
"lessThanOrEqual": "6.10"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*"
],
"vendor": "linux",
"product": "linux_kernel",
"versions": [
{
"status": "unaffected",
"version": "6.10_rc1"
}
],
"defaultStatus": "unknown"
}
]
git.kernel.org/stable/c/042a39bb8e0812466327a5102606e88a5a4f8c02
git.kernel.org/stable/c/066afafc10c9476ee36c47c9062527a17e763901
git.kernel.org/stable/c/0c38c9c460bb8ce8d6f6cf316e0d71a70983ec83
git.kernel.org/stable/c/13857683126e8a6492af73c74d702835f7a2175b
git.kernel.org/stable/c/87586467098281f04fa93e59fe3a516b954bddc4