CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
AI Score
Confidence
High
EPSS
Percentile
13.0%
In the Linux kernel, the following vulnerability has been resolved:
tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
Assuming the following:
Fix this by changing gsm->count to gsm->len comparison from equal to less
than. Also add upper limit checks against the constant MAX_MRU in
gsm0_receive() and gsm1_receive() to harden against memory corruption of
gsm->len and gsm->mru.
All other checks remain as we still need to limit the data according to the
user configuration and actual payload size.
git.kernel.org/stable/c/0fb736c9931e02dbc7d9a75044c8e1c039e50f04
git.kernel.org/stable/c/46f52c89a7e7d2691b97a9728e4591d071ca8abc
git.kernel.org/stable/c/47388e807f85948eefc403a8a5fdc5b406a65d5a
git.kernel.org/stable/c/4c267110fc110390704cc065edb9817fdd10ff54
git.kernel.org/stable/c/774d83b008eccb1c48c14dc5486e7aa255731350
git.kernel.org/stable/c/9513d4148950b05bc99fa7314dc883cc0e1605e5
git.kernel.org/stable/c/b229bc6c6ea9fe459fc3fa94fd0a27a2f32aca56
git.kernel.org/stable/c/b890d45aaf02b564e6cae2d2a590f9649330857d
git.kernel.org/stable/c/f126ce7305fe88f49cdabc6db4168b9318898ea3