In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/atm: fix slab-out-of-bounds read in vcc_setsockopt()<\/p>\n
vcc_setsockopt() contained an ineffective optlen check:
\n if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname))
\n return -EINVAL;<\/p>\n
If __SO_LEVEL_MATCH(optname, level) evaluated to false (e.g. if the caller
\npassed a mismatched level), the length check optlen != __SO_SIZE(optname)
\nwas short-circuited and bypassed. Execution then fell through to switch(optname),
\ncalling copy_from_sockptr() assuming optval contained sufficient space.<\/p>\n
Furthermore, even if level matched, a cgroup BPF setsockopt filter could shrink
\noptlen after entry. Because copy_from_sockptr() on kernel pointers uses memcpy(),
\nthis leads to a KASAN slab-out-of-bounds read when optlen is smaller than the
\nexpected structure size.<\/p>\n
Fix this by using copy_safe_from_sockptr(), which unconditionally validates
\nthat optlen is at least the expected size before copying. Also change the local
\n‘value’ variable type from ‘unsigned long’ to ‘int’ so that SO_SETCLP matches
\nits sizeof(int) ABI encoding on 64-bit systems.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/atm: fix slab-out-of-bounds read in vcc_setsockopt()<\/p>\n
vcc_setsockopt() contained an ineffective optlen check:
\n if (__SO_LEVEL_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11263","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11263","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11263"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11263"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11263"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}