Buffer Overflow in Linux Kernel IIO ADXL380 Driver

Impact Analysis

This vulnerability in the Linux kernel's iio: accel: adxl380 driver can cause the interrupt handler to read more FIFO entries than are actually present. This happens because the number of entries reported by the FIFO status registers may not be a multiple of the number of scan elements enabled, leading to reading beyond the available data.

The impact could include incorrect sensor data processing or potential instability in systems relying on accurate sensor readings, as the driver may process invalid or excess data entries.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Linux kernel's iio accel adxl380 driver. The issue arises because the interrupt handler reads FIFO entries in batches based on the number of enabled scan elements (N). However, the sensor fills the FIFO one sample at a time, even if multiple channels are enabled. This means the FIFO status register may report a number of entries that is not a multiple of N, causing the handler to read more entries than are actually present.

The fix involves rounding down the number of FIFO entries read from the status registers so that it is always a multiple of N, preventing reading beyond the actual entries.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by updating the Linux kernel to a version where the interrupt handler for the adxl380 sensor reads the FIFO entries correctly by rounding down the number of entries read to a multiple of the number of scan elements enabled.

Therefore, the immediate step to mitigate this vulnerability is to update your Linux kernel to the fixed version that includes this patch.

Useful 0 Not Useful 0