Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d496a002 authored by Quentin Casasnovas's avatar Quentin Casasnovas Committed by Borislav Petkov
Browse files

x86/microcode/intel: Fix out of bounds memory access to the extended header 



Improper pointer arithmetics when calculating the address of the
extended header could lead to an out of bounds memory read and kernel
panic.

Signed-off-by: default avatarQuentin Casasnovas <quentin.casasnovas@oracle.com>
Link: http://lkml.kernel.org/r/20150225094125.GB30434@chrystal.uk.oracle.com


Signed-off-by: default avatarBorislav Petkov <bp@suse.de>
parent c517d838

arch/x86/kernel/cpu/microcode/intel_early.c

+2 −4
Original line number Diff line number Diff line
@@ -180,8 +180,7 @@ matching_model_microcode(struct microcode_header_intel *mc_header, 
	if (total_size <= data_size + MC_HEADER_SIZE)

		return UCODE_NFOUND;



	ext_header = (struct extended_sigtable *)

		     mc_header + data_size + MC_HEADER_SIZE;

	ext_header = (void *) mc_header + data_size + MC_HEADER_SIZE;

	ext_sigcount = ext_header->count;

	ext_sig = (void *)ext_header + EXT_HEADER_SIZE;
@@ -457,8 +456,7 @@ static void __ref show_saved_mc(void) 
		if (total_size <= data_size + MC_HEADER_SIZE)

			continue;



		ext_header = (struct extended_sigtable *)

			     mc_saved_header + data_size + MC_HEADER_SIZE;

		ext_header = (void *) mc_saved_header + data_size + MC_HEADER_SIZE;

		ext_sigcount = ext_header->count;

		ext_sig = (void *)ext_header + EXT_HEADER_SIZE;