Linux Kernel VEML6075 Light Sensor Driver Out-of-Bounds Access Vulnerability

A vulnerability in the Linux kernel's VEML6075 light sensor driver can lead to out-of-bounds array access. The issue arises because the VEML6075_CONF_IT register can return values that exceed the valid range, causing the driver to read reserved values that should never be accessed. This vulnerability has been addressed by adding a bounds check to ensure the index remains within the appropriate range, thereby preventing potential errors from faulty devices or bus corruption.

Impact

Exploitation of this vulnerability could lead to out-of-bounds memory access, which may cause undefined behavior such as memory corruption or crashes.

Reproduction

The vulnerability can be reproduced by configuring the VEML6075 light sensor driver to read the VEML6075_CONF_IT register. If the register returns a value of 5 or higher, the driver will attempt to access an invalid index in the veml6075_it_ms array, which only has 5 valid elements (indexed 0-4). This out-of-bounds access can be triggered by manipulating the driver's configuration or by introducing a faulty device that sends incorrect register values.

Remediation

Users can update to the latest version of the Linux kernel, where this vulnerability has been fixed. Instructions for downloading the patched version are available on the official Linux kernel website.