Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_kmsg_record() accesses s[len - 1] to strip the trailing newline, but len is unsigned int. If len is 0, the subtraction wraps to UINT_MAX, causing an out-of-bounds read. Add an early return when len is 0.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 25e2c2a3eff55683bbe77b108db2a7e389246666 before 16a2716910ecf7d31bf3c033ee7c506a0b00b2ee; affected 25e2c2a3eff55683bbe77b108db2a7e389246666 before 16bcea56f4205314ec2aa04a7ec74e5261d253c7; affected 25e2c2a3eff55683bbe77b108db2a7e389246666 before 60baa179ed1333535f6e2da4133511db55278ee4 |
| Linux / Linux | affected 6.14; unaffected 0 before 6.14; unaffected 6.18.46 through 6.18.*; unaffected 7.1.10 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.