In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: fix OOB read in decode_watchers() via missing bounds check<\/p>\n
ceph_start_decoding() validates that struct_len bytes remain in the
\nbuffer after the encoding header, but accepts struct_len=0 as valid:
\nceph_decode_need(p, end, 0, bad) always passes. When a malicious or
\ncompromised OSD sends an obj_list_watch_response_t reply with
\nstruct_len=0, ceph_start_decoding() returns success with p == end,
\nleaving zero bytes guaranteed for subsequent reads.<\/p>\n
The immediately following ceph_decode_32(p) in decode_watchers() has
\nno preceding bounds check. With p == end this is a 4-byte read past
\nthe validated buffer boundary. The garbage value is then passed
\ndirectly to kzalloc_objs() as the watcher count.<\/p>\n
The sibling function decode_watcher() already uses the safe variants
\n(ceph_decode_copy_safe, ceph_decode_64_safe, ceph_decode_skip_32)
\nafter its own ceph_start_decoding() call. decode_watchers() is the
\nonly site that uses the bare variant, confirming an oversight.<\/p>\n
Fix by replacing ceph_decode_32(p) with ceph_decode_32_safe(p, end,
\n*num_watchers, bad), consistent with the established pattern.<\/p>\n
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
\ndeployment (e.g. cloud) can trigger this against any kernel client
\nthat calls CEPH_OSD_OP_LIST_WATCHERS, without any further privileges
\nbeyond OSD session establishment.<\/p>\n
[ idryomov: trim changelog ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: fix OOB read in decode_watchers() via missing bounds check<\/p>\n
ceph_start_decoding() validates that struct_len bytes remain i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11962","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11962","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11962"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11962"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11962"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}