In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: Avoid using invalid osd indices from primary_temp<\/p>\n
A corrupted osdmap received from a Ceph monitor or OSD may contain osd
\nindices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts
\nthat don’t exist, i.e., that are greater than max_osd or smaller than
\nCEPH_HOMELESS_OSD (-1). These indices are used to create the up and
\nacting set in ceph_pg_to_up_acting_osds(), called from calc_target().
\nWhile most of these osd indices are checked, the one from primary_temp
\nis not. Subsequently, this may lead to calc_target() returning this
\n(potentially invalid) index as target osd for a (linger) request.
\nBecause the osd_state, osd_weight, and osd_addr arrays only contain
\nmax_osd entries (with indices 0 to max_osd -1), this leads to
\nout-of-bounds accesses when trying to read values from these arrays.<\/p>\n
This patch fixes the issue by adding a check to get_temp_osds(), so that
\nonly valid osd indices from primary_temp are used, and it falls back to
\nusing the primary from pg_temp or the up set if it is invalid.<\/p>\n
[ idryomov: changelog ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: Avoid using invalid osd indices from primary_temp<\/p>\n
A corrupted osdmap received from a Ceph monitor or OSD may contain osd<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11963","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}