In the Linux kernel, the following vulnerability has been resolved:
wifi: iwlwifi: pcie: Fix integer overflow in iwlwritetouserbuf
An integer overflow occurs in the iwlwritetouserbuf() function, which is called by the iwldbgfsmonitordataread() function.
static bool iwlwritetouserbuf(char _user *userbuf, ssizet count, void *buf, ssizet *size, ssizet *bytescopied) { int bufsizeleft = count - *bytes_copied;
buf_size_left = buf_size_left - (buf_size_left % sizeof(u32));
if (*size > buf_size_left)
*size = buf_size_left;
If the user passes a SIZEMAX value to the "ssizet count" parameter, the ssizet count parameter is assigned to "int bufsizeleft". Then compare "*size" with "bufsizeleft" . Here, "bufsizeleft" is a negative number, so "*size" is assigned "bufsizeleft" and goes into the third argument of the copyto_user function, causing a heap overflow.
This is not a security vulnerability because iwldbgfsmonitordataread() is a debugfs operation with 0400 privileges.