Threats Tagged 'ghsa-5mqj-jpm9-chwp'

A vulnerability in the Linux kernel's USB Type-C wcove driver was resolved to prevent out-of-bounds writes in the wcove_read_rx_buffer() function. The issue arises because the function copies data from a PD RX FIFO into a struct pd_message without properly limiting the copy size, potentially writing one byte beyond the destination buffer. Additionally, the use of regmap_read() writes four bytes per iteration, causing up to three zero bytes to be written past the buffer on the final iteration. This could corrupt stack memory in the IRQ thread. The fix clamps the copy loop to the size of struct pd_message and reads each register into a local variable before storing only the low byte, preventing overflow regardless of the RXINFO byte count.