In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/bnxt_re: zero shared page before exposing to userspace<\/p>\n
bnxt_re_alloc_ucontext() allocates uctx->shpg via
\n__get_free_page(GFP_KERNEL). The buddy allocator does not zero pages
\nwithout __GFP_ZERO, so the page contains stale kernel data from
\nwhatever object most recently freed it.<\/p>\n
The page is then mapped into userspace via vm_insert_page() under
\nBNXT_RE_MMAP_SH_PAGE in bnxt_re_mmap(). The driver only ever writes
\n4 bytes (a u32 AVID) at offset BNXT_RE_AVID_OFFT (0x10) inside
\nbnxt_re_create_ah(); the remaining 4092 bytes of the page are exposed
\nto userspace unsanitised, leaking kernel memory contents.<\/p>\n
Any user with access to \/dev\/infiniband\/uverbsX on a host with a
\nbnxt_re device (typically rdma group membership) can read this data
\nvia a single mmap() at pgoff 0 after IB_USER_VERBS_CMD_GET_CONTEXT.<\/p>\n
Other shared pages in the same file already use get_zeroed_page()
\ncorrectly:<\/p>\n
drivers\/infiniband\/hw\/bnxt_re\/ib_verbs.c
\n srq->uctx_srq_page = (void *)get_zeroed_page(GFP_KERNEL);
\n cq->uctx_cq_page = (void *)get_zeroed_page(GFP_KERNEL);<\/p>\n
uctx->shpg is the only outlier. Bring it in line with the existing
\nconvention by switching to get_zeroed_page().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/bnxt_re: zero shared page before exposing to userspace<\/p>\n
bnxt_re_alloc_ucontext() allocates uctx->shpg via
\n__get_free_page(GFP_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11195","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11195","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11195"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11195"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11195"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}