CVE-2016-10764 In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so th...
CriticalCVSS 9.8
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In the Linux kernel before 4.9.6, there is an off by one in the drivers/mtd/spi-nor/cadence-quadspi.c cqspi_setup_flash() function. There are CQSPI_MAX_CHIPSELECT elements in the ->f_pdata array so the ">" should be ">=" instead.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 4.9.6-1 | 4.9.6-1 |
| debian/linux(Debian:13) | < 4.9.6-1 | 4.9.6-1 |
| debian/linux(Debian:14) | < 4.9.6-1 | 4.9.6-1 |
| Linux kernel | >= 4.8, < 4.9.6 | 4.9.6 |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2016-10764 vendor-advisory
- git.kernel.org patch vendor-advisory
- github.com patch third-party-advisory
- mirrors.edge.kernel.org release-notes third-party-advisory
- support.f5.com third-party-advisory
- support.f5.com