CVE-2021-47633

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111

The bug was found during fuzzing. Stacktrace locates it in

ath5k_eeprom_convert_pcal_info_5111.

When none of the curve is selected in the loop, idx can go

up to AR5K_EEPROM_N_PD_CURVES. The line makes pd out of bound.

pd = &chinfo[pier].pd_curves[idx];

There are many OOB writes using pd later in the code. So I

added a sanity check for idx. Checks for other loops involving

AR5K_EEPROM_N_PD_CURVES are not needed as the loop index is not

used outside the loops.

The patch is NOT tested with real device.

The following is the fuzzing report

BUG: KASAN: slab-out-of-bounds in ath5k_eeprom_read_pcal_info_5111+0x126a/0x1390 [ath5k]

Write of size 1 at addr ffff8880174a4d60 by task modprobe/214

CPU: 0 PID: 214 Comm: modprobe Not tainted 5.6.0 #1

Call Trace:

dump_stack+0x76/0xa0

print_address_description.constprop.0+0x16/0x200

? ath5k_eeprom_read_pcal_info_5111+0x126a/0x1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References