Linux kernel ACPI PFR update stack buffer overflow fix (CVE-2023-5198)

Vulnerability Summary Overview Vulnerability Name: ACPI: pfr: update: Fix stack buffer overflow in Vulnerability Type: Stack buffer overflow Root Cause: directly uses the returned by firmware in without validating the length, causing an overflow when exceeds the size of the target array. Scope of Impact Affected File: Affected Functions: / Trigger Condition: When the returned by firmware exceeds the value of the respective fields (e.g., , , , etc.) in , the will write beyond the target array. Affected Versions: Linux kernel stable branch (linux.git), fixed in commit . Fix Details Fix Approach: Introduce a helper pointer to validate the length of each buffer. If exceeds the of the corresponding field, return to prevent the overflow. Key Fix Code: ```c static int query_capability(struct pfru_update_cap_info *cap, hdr, goto free_acpi_buffer; cap->hdr->update_cap = elem(CAP_UPDATE_IDX).integer.value; if (!elem(CAP_TYPE_IDX).buffer.length > sizeof(cap->hdr->drv_type) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->svn_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id) elem(CAP_DRV_RT_VER_IDX).buffer.length > sizeof(cap->hdr->rt_version) elem(CAP_DRV_SVN_IDX).buffer.length > sizeof(cap->hdr->drv_svn) elem(CAP_PLAT_ID_IDX).buffer.length > sizeof(cap->hdr->plat_id)

Goal Reached Thanks to every supporter — we hit 100%!

Linux kernel ACPI PFR update stack buffer overflow fix (CVE-2023-5198)