In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usx2y: bound the hwdep mmap fault offset<\/p>\n
snd_us428ctls_vm_fault() turns the faulting page offset into a kernel
\naddress with no bound of any kind:<\/p>\n
\toffset = vmf->pgoff <us428ctls_sharedmem + offset;
\n\tpage = virt_to_page(vaddr);
\n\tget_page(page);
\n\tvmf->page = page;<\/p>\n
\treturn 0;<\/p>\n
snd_us428ctls_mmap() checks only the length of the mapping, never the
\noffset, and us428ctls_sharedmem is a single page from
\nalloc_pages_exact(). For a character device file_mmap_size_max()
\nreturns ULONG_MAX, so the mm layer imposes no ceiling either. Every page
\noffset above zero resolves to a struct page outside the object, and the
\nhandler installs it into the caller’s address space read-write; the vma
\nis not marked read-only.<\/p>\n
The caller picks the page frame with a single mmap() argument and gets
\nread-write access to a page of kernel memory it does not own; an offset
\nthat lands in an unpopulated vmemmap region oopses instead.<\/p>\n
A process that can open the hwdep node of an attached US-X2Y reaches
\nthis after loading the FPGA image through the same node; no capability
\ncheck is involved.<\/p>\n
On 7.2.0-rc5 (arm64), mmap() with a large offset:<\/p>\n
Unable to handle kernel paging request at virtual address fffffdffc45d5ac8
\n pc : snd_us428ctls_vm_fault+0x68\/0x140 [snd_usb_usx2y]
\n Call trace:
\n snd_us428ctls_vm_fault+0x68\/0x140 [snd_usb_usx2y]
\n __do_fault
\n __handle_mm_fault
\n handle_mm_fault
\n el0_da<\/p>\n
Reject any offset outside the shared region. The pcm hwdep handler in
\nusx2yhwdeppcm.c computes its address the same way and needs the same
\nbound.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usx2y: bound the hwdep mmap fault offset<\/p>\n
snd_us428ctls_vm_fault() turns the faulting page offset into a kernel
\naddress with <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11238","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11238","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11238"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11238"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11238"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}