CVE-2023-53729

In the Linux kernel, the following vulnerability has been resolved:

soc: qcom: qmi_encdec: Restrict string length in decode

The QMI TLV value for strings in a lot of qmi element info structures account for null terminated strings with MAX_LEN + 1. If a string is actually MAX_LEN + 1 length, this will cause an out of bounds access when the NULL character is appended in decoding.

Fixes a potential out-of-bounds write in Qualcomm’s QMI (Qualcomm Messaging Interface) string decoder, where a string of length equal to the declared maximum could overflow by one byte when appending the null terminator. This could lead to kernel memory corruption and potential denial-of-service if malformed QMI messages are processed, e.g., via a compromised modem or firmware-controlled interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.