In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot<\/p>\n
On the SMC-D client, slot 0 of ini->ism_dev[]\/ini->ism_chid[] is
\nreserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt()
\npopulates V2 entries starting at index 1, so when no V1 device is
\nselected slot 0 is left in its kzalloc()’ed state with ism_dev[0] ==
\nNULL and ism_chid[0] == 0.<\/p>\n
smc_v2_determine_accepted_chid() then matches the peer’s CHID against
\nthe array starting from index 0 using the CHID alone. A malicious
\npeer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches
\nthe empty slot, ini->ism_selected becomes 0, and the subsequent
\nism_dev[0]->lgr_lock dereference in smc_conn_create() faults at
\noffsetof(struct smcd_dev, lgr_lock) == 0x68:<\/p>\n
BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79\/0xe0
\n Write of size 4 at addr 0000000000000068 by task exploit\/144
\n Call Trace:
\n _raw_spin_lock_bh
\n smc_conn_create (net\/smc\/smc_core.c:1997)
\n __smc_connect (net\/smc\/af_smc.c:1447)
\n smc_connect (net\/smc\/af_smc.c:1720)
\n __sys_connect
\n __x64_sys_connect
\n do_syscall_64<\/p>\n
Require ism_dev[i] to be non-NULL before accepting a CHID match.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot<\/p>\n
On the SMC-D client, slot 0 of ini->ism_dev[]\/ini->ism_chid[] is<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15037","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15037","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15037"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15037"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15037"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}