The Linux kernel's w1 driver for the DS28E17 device reads a length byte from the device on an I2C_M_RECV_LEN read and then reads that many bytes into a buffer. The buffer size is limited to 34 bytes, but the length byte can be up to 255, causing reads beyond the buffer boundary by up to approximately 222 bytes. Although the SMBus core checks the length after the transfer, the out-of-bounds read occurs before this check. The fix involves rejecting length values above the maximum allowed (I2C_SMBUS_BLOCK_MAX) at both points where the length is processed, preventing the out-of-bounds read.

This vulnerability can cause out-of-bounds reads in kernel memory due to an oversize length value during an I2C block read operation. Such out-of-bounds reads may lead to kernel memory corruption or information disclosure, depending on the context and usage. However, no active exploits are known, and the issue is resolved in the kernel.

A fix is available that rejects oversize length values at both relevant points in the driver code, preventing out-of-bounds reads. Users should update their Linux kernel to a version that includes this fix. Since this is a kernel-level vulnerability, applying the official kernel update is the recommended remediation.