Linux Kernel Cros Ec Chardev Ioctl Data Leak Vulnerability

A vulnerability in the Linux kernel's Chrome platform component, specifically within the Cros EC character device, has been addressed. This vulnerability allowed for a kernel data leak through the ioctl interface by manipulating the 'insize' parameter in the 'cros_ec_command' structure. The issue arose because larger 'insize' values could be used to access and read unintended kernel memory. The vulnerability has been fixed by ensuring that the memory used is properly zeroed before being utilized.

Impact

Exploitation of this vulnerability could lead to unauthorized access to kernel memory, allowing for potential information leaks or exposure of sensitive data.