Executive brief
The Linux kernel's ChromeOS platform driver contains a memory corruption vulnerability in the ioctl handler used to read memory from the embedded controller. An attacker with local access to the device can supply an oversized buffer size parameter that bypasses validation, causing the kernel to write beyond allocated memory boundaries. This can lead to kernel crash, data corruption, or privilege escalation.
Technical details
The vulnerability is a buffer overflow in the `cros_ec_chardev_ioctl_readmem()` function in `drivers/platform/chrome/cros_ec_chardev.c`. The code copies user-supplied data including a `s_mem.bytes` field from userspace without validating that it does not exceed the size of the destination buffer `s_mem.buffer`. An attacker with local access can invoke the ioctl with a maliciously large `bytes` value, causing `cmd_readmem()` to read beyond the buffer boundary and corrupt kernel memory. The fix adds a bounds check: `if (s_mem.bytes > sizeof(s_mem.buffer)) return -EINVAL;`. Local privilege is required to access the character device. A successful exploit can result in kernel panic, data corruption, or code execution.
Affected products
- Linux Linux kernel multiple versions (patched in stable trees)
Timeline
- 2022-08-19: disclosed
- 2022-10-21: patched
- 2025-10-22: advisory