In the Linux kernel, the following vulnerability has been resolved:
media: stk1160: fix bounds checking in stk1160copyvideo()
The subtract in this condition is reversed. The ->length is the length of the buffer. The ->bytesused is how many bytes we have copied thus far. When the condition is reversed that means the result of the subtraction is always negative but since it's unsigned then the result is a very high positive value. That means the overflow check is never true.
Additionally, the ->bytesused doesn't actually work for this purpose because we're not writing to "buf->mem + buf->bytesused". Instead, the math to calculate the destination where we are writing is a bit involved. You calculate the number of full lines already written, multiply by two, skip a line if necessary so that we start on an odd numbered line, and add the offset into the line.
To fix this buffer overflow, just take the actual destination where we are writing, if the offset is already out of bounds print an error and return. Otherwise, write up to buf->length bytes.
[
{
"id": "CVE-2024-38621-0b32118c",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a08492832cc4cacc24e0612f483c86ca899b9261",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-10bf7d96",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d410017a7181cb55e4a5c810b32b75e4416c6808",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-15a5ad5b",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a08492832cc4cacc24e0612f483c86ca899b9261",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-29338e3d",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6a392266276730bea893b55d12940e32a25f56a",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-2d81306a",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecf4ddc3aee8ade504c4d36b7b4053ce6093e200",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-3f0327dc",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a16775828aaed1c54ff4e6fe83e8e4d5c6a50cb7",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-668bc658",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6a392266276730bea893b55d12940e32a25f56a",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-696b7800",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b504518a397059e1d55c521ba0ea2b545a6c4b52",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-6b15c270",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faa4364bef2ec0060de381ff028d1d836600a381",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-7df26e90",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ecf4ddc3aee8ade504c4d36b7b4053ce6093e200",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-7ef81fe0",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@faa4364bef2ec0060de381ff028d1d836600a381",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-7f49ff16",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7532bcec0797adfa08791301c3bcae14141db3bd",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-839734fe",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d410017a7181cb55e4a5c810b32b75e4416c6808",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-b6147bae",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"303570937305173828481142436461561150953",
"183820704654040969111703461645282182719",
"61872920721140597395795247085962219542",
"69038594865199384118499983014313700125",
"325241416486458629243971307330185259397",
"90489709732512959936931963452717903964",
"18674961785441360954779857334778042829",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368",
"85872058317695194687865532868376834066",
"153150410480612068494665901259574138740",
"186489738629754874550398236150079904804",
"113401602634913893441889316033284571689",
"15404559782297908990558173502560967368"
]
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7532bcec0797adfa08791301c3bcae14141db3bd",
"target": {
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-bef20a27",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b504518a397059e1d55c521ba0ea2b545a6c4b52",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
},
{
"id": "CVE-2024-38621-cd5f8992",
"signature_type": "Function",
"digest": {
"length": 1546.0,
"function_hash": "114168526008388402086975243792386516323"
},
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a16775828aaed1c54ff4e6fe83e8e4d5c6a50cb7",
"target": {
"function": "stk1160_copy_video",
"file": "drivers/media/usb/stk1160/stk1160-video.c"
},
"signature_version": "v1"
}
]