Linux Kernel MH-Z19B Oversized Serial Reply Handling Vulnerability

A vulnerability in the Linux kernel's handling of serial replies from the MH-Z19B CO2 sensor has been addressed. The issue arose because the 'mhz19b_receive_buf()' function did not properly check if incoming data chunks fit within the designated buffer, leading to potential buffer overflows. This flaw could allow oversized replies to overwrite important state information before the command processing could validate the response. The vulnerability has been fixed by adding checks to reject oversized replies and by resetting the reply state before each command, ensuring that the buffer is not improperly overwritten.

Impact

The vulnerability could lead to a buffer overflow, allowing for potential memory corruption or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by sending oversized serial replies to the MH-Z19B sensor. The 'mhz19b_receive_buf()' function will append each chunk to the fixed-size receive buffer without checking if there is enough space, causing an overflow.

Remediation

Users can update to the latest version of the Linux kernel where this vulnerability has been fixed.