CVE-2024-26593: i2c: i801: Fix block process call transactions
i2c: i801: Fix block process call transactions
According to the Intel datasheets, software must reset the block buffer index twice for block process call transactions: once before writing the outgoing data to the buffer, and once again before reading the incoming data from the buffer.
The driver is currently missing the second reset, causing the wrong portion of the block buffer to be read.
Other sources
Linux Kernel could allow a local authenticated attacker to obtain sensitive information, caused by an out-of-bounds read within i2c: i801. An attacker could exploit this vulnerability to cause the wrong portion of the block buffer to be read or a denial of service.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26593?
CVE-2024-26593 has a moderate severity level, affecting the block process call transactions in the i2c subsystem.
How do I fix CVE-2024-26593?
To fix CVE-2024-26593, update the Linux kernel to a version that addresses this vulnerability, such as 5.10.223-1 or later.
Which versions of the Linux kernel are affected by CVE-2024-26593?
CVE-2024-26593 affects Linux kernel versions between 5.3.0 and 6.7.6 inclusive.
Is CVE-2024-26593 related to a specific component in the Linux kernel?
Yes, CVE-2024-26593 specifically affects the i2c: i801 component within the Linux kernel.
What potential impact does CVE-2024-26593 have on systems?
If exploited, CVE-2024-26593 may lead to improper handling of block process calls, which could affect system stability and data integrity.