Vulnerability in Kernel package: eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
Summary
GSD-2022-1000379: eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX. Affects Kernel versions >= 25714ad6bf5e98025579fa4c08ff2041a663910c, < a37960df7eac3cc8094bd1ab84864e9e32c91345. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Kernel package is a fundamental component of the Linux operating system. It provides the core functionality and interfaces for various hardware devices and software components. The eeprom module within the Kernel package is responsible for handling interactions with EEPROM (Electrically Erasable Programmable Read-Only Memory) devices. EEPROMs are non-volatile memory chips used to store small amounts of data that need to be retained even when power is removed. This vulnerability specifically affects the ee1004 driver in the eeprom module.
Vulnerability Detail
The vulnerability in the ee1004 driver of the eeprom module allows for unbounded I2C reads, potentially leading to buffer overflows or other memory corruption issues. By not limiting the size of I2C reads, an attacker could send maliciously crafted requests that exceed the expected buffer size, causing memory corruption and potentially leading to arbitrary code execution or system crashes. This vulnerability was introduced in Linux Kernel version v5.10.94 and has been fixed in version v5.10.101.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If updating the Kernel package is not immediately feasible, a temporary workaround is to limit the size of I2C reads to the maximum allowed value (I2C_SMBUS_BLOCK_MAX). This can be achieved by modifying the code in the ee1004 driver to enforce the size limit. Below is an example of the code change:
// Limit I2C reads to I2C_SMBUS_BLOCK_MAX
if (size > I2C_SMBUS_BLOCK_MAX) {
size = I2C_SMBUS_BLOCK_MAX;
}
Conclusion
The vulnerability in the ee1004 driver of the eeprom module in the Kernel package allows for unbounded I2C reads, potentially leading to memory corruption and arbitrary code execution. It is crucial to update the Kernel package to version v5.10.101 or later to mitigate this vulnerability. If immediate update is not possible, applying the provided workaround to limit the size of I2C reads can help reduce the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
This vulnerability could potentially allow an attacker to execute arbitrary code or crash the system by exploiting memory corruption issues.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any known vulnerabilities, including this one.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is always recommended to apply security patches promptly to mitigate any potential risks.
The primary solution is to update the Kernel package to the fixed version. If updating immediately is not possible, applying the provided workaround to limit the size of I2C reads can help mitigate the risk until the update can be performed.
No, this vulnerability affects the Kernel package in general and is not specific to any particular Linux distribution. However, the fix should be applied through the official update process provided by the specific distribution being used.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
