In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: fix multiple unsafe decodes in decode_locker()<\/p>\n
decode_locker() in cls_lock_client.c contains three unsafe decode
\noperations that allow a malicious or compromised OSD to trigger
\nslab-out-of-bounds reads:<\/p>\n
1. ceph_decode_copy() at the locker_id_t name field has no preceding
\n bounds check. With p == end after ceph_start_decoding() accepts
\n struct_len=0, this reads sizeof(ceph_entity_name) = 9 bytes past
\n the validated buffer boundary.<\/p>\n
2. *p += sizeof(struct ceph_timespec) after the locker_info_t header
\n is an unchecked pointer advance. A malicious OSD can position p
\n past end, causing all subsequent _safe checks to pass against a
\n bogus boundary.<\/p>\n
3. len = ceph_decode_32(p) has no preceding bounds check, and the
\n immediately following *p += len is uncapped. A malicious OSD can
\n send len=0xffffffff, advancing p gigabytes past end and escaping
\n the decode window entirely.<\/p>\n
Fix all three by replacing bare operations with their safe variants:
\n ceph_decode_copy -> ceph_decode_copy_safe
\n *p += sizeof(…) -> ceph_decode_skip_n
\n ceph_decode_32(p) -> ceph_decode_32_safe
\n *p += len -> ceph_decode_skip_n<\/p>\n
A new label is added to return -EINVAL on any bounds violation.
\n-EINVAL is appropriate here: the data received from the OSD
\nis structurally malformed, which is an invalid argument to the decode
\ncontract regardless of whether the caller or the wire is at fault.<\/p>\n
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
\ndeployment can trigger this against any kernel client that issues the
\nlock.get_info class method (e.g. during RBD exclusive lock acquisition)
\nwithout any further privileges beyond OSD session establishment.<\/p>\n
[ idryomov: use ceph_decode_skip_string() to skip description, trim
\n changelog ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: fix multiple unsafe decodes in decode_locker()<\/p>\n
decode_locker() in cls_lock_client.c contains three unsafe decode
\noperatio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11966","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11966","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11966"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11966"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11966"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}