In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name '\0' termination, aka CID-cc7a0bb058b8.
| Software | From | Fixed in |
|---|---|---|
| fedoraproject / fedora | 32 | 32.x |
| fedoraproject / fedora | 33 | 33.x |
| fedoraproject / fedora | 34 | 34.x |
| linux / linux_kernel | 5.11 | 5.11.9 |
| linux / linux_kernel | 4.15.x | 4.19.183.x |
| linux / linux_kernel | 4.5.x | 4.9.263.x |
| linux / linux_kernel | 5.5.0 | 5.10.26 |
| linux / linux_kernel | 4.20 | 5.4.108 |
| linux / linux_kernel | 4.10 | 4.14.227 |
| linux / linux_kernel | - | 4.4.263 |