1955 – [Anolis OS 7] Bugfix for CVE-2022-2873

Bug 1955 - [Anolis OS 7] Bugfix for CVE-2022-2873

Summary: [Anolis OS 7] Bugfix for CVE-2022-2873

Status:	RESOLVED WONTFIX

Alias:	None

Product:	Anolis OS 7
Classification:	Anolis OS
Component:	BaseOS Packages (show other bugs)	BaseOS Packages
Sub Component:
Version:	7.7
Hardware:	All Linux

Importance:	P3-Medium S3-normal
Target Milestone:	---
Assignee:	GuixinLiu
QA Contact:	杨晓旋

URL:
Whiteboard:
Keywords:	CVE

Duplicates (1):	1970 (view as bug list)
Depends on:
Blocks:

Reported:	2022-08-24 18:54 UTC by 小龙
Modified:	2022-09-13 17:48 UTC (History)
CC List:	2 users (show)

See Also:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description 小龙 admin

2022-08-24 18:54:44 UTC

An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system.

Comment 1 Shiloong admin

2022-08-25 10:42:44 UTC

CVSS：6.2
Severity：Moderate

CVE-center：
https://cve-center.openanolis.cn/official/detail?cve_id=CVE-2022-2873

bugfix：
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id=690b2549b19563ec5ad53e5c82f6a944d910086e

Comment 2 zuoyou alibaba_cloud_group

2022-08-25 19:13:17 UTC

*** Bug 1970 has been marked as a duplicate of this bug. ***

Comment 3 GuixinLiu alibaba_cloud_group

2022-09-13 17:48:47 UTC

Anolis4.19和Anolis5.10都没有合入这个patch 5e9a97b1f4491b8b65874901ad084348fcaba327，不支持I2C_SMBUS_BLOCK_PROC_CALL，就没有这个switch case分支，就没有数组越界的问题。