On Fri, 24 Mar 2023 14:40:38 +0100, Takashi Iwai wrote: > > Hi, > > I was asked about the handling for CVE-2022-40540 [*] on SUSE kernels, > and through a quick glance, the upstream code still misses the fix. > Namely, the downstream fix for the integer overflow check of the > firmware size below: > https://git.codelinaro.org/clo/la/kernel/msm-5.10/-/commit/dae3214cd3495e5c4b37537cacf665d2cdeaea24 > ... can be applied to the current upstream code (as of 6.3-rc3) as far > as I understand. > > Could you guys check it and apply the fix if really needed? Any news on this? This security issue seems still present in the latest upstream and linux-next. thanks, Takashi > > > Thanks! > > Takashi > > [*] > http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-40540 > https://bugzilla.redhat.com/show_bug.cgi?id=2180513 > https://www.cve.org/CVERecord?id=CVE-2022-40540 > https://www.qualcomm.com/company/product-security/bulletins/march-2023-bulletin
