In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/rsrc: fix folio size overflow in io_vec_fill_bvec()<\/p>\n
io_vec_fill_bvec() computes the folio size with a plain int 1:<\/p>\n
\tunsigned long folio_size = 1 <folio_shift;<\/p>\n
imu->folio_shift is unsigned int and comes from folio_shift() of the
\nfolio backing the registered buffer, so it can be 32 or more on a 64 bit
\nkernel. Shifting int 1 that far is undefined, and on x86 and arm64 the
\ncount is taken modulo 32, so a shift of 34 yields 4 rather than 16G.
\nEvery other folio_shift shift in this file already uses 1UL.<\/p>\n
The result is that the segment estimate and the fill loop disagree.
\nio_estimate_bvec_size() sizes the bvec array with the real shift:<\/p>\n
\tmax_segs += (iov[i].iov_len >> shift) + 2;<\/p>\n
so a 1M iovec on a 16G folio is charged 2 segments, while
\nio_vec_fill_bvec() then walks the same iovec in folio_size chunks of 4
\nbytes and writes res_bvec[bvec_idx] a quarter of a million times, past
\nthe end of the array it was given. src_bvec is advanced once per
\niteration as well, so imu->bvec is read past its end at the same time.
\nvalidate_fixed_range() only checks that the range is inside the
\nregistered buffer and does not bound the segment count.<\/p>\n
Reaching it needs a folio with a shift of at least 32, which means a
\ngigantic hugetlb page: 16G on arm64 with 64K pages, where
\nCONT_PMD_SHIFT is 34 and hugetlb_add_hstate(CONT_PMD_SHIFT – PAGE_SHIFT)
\nregisters that size, and likewise on powerpc. x86_64 tops out at 1G, so
\na shift of 30, which still fits in int and is unaffected.<\/p>\n
Use 1UL, as the rest of the file does.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
io_uring\/rsrc: fix folio size overflow in io_vec_fill_bvec()<\/p>\n
io_vec_fill_bvec() computes the folio size with a plain int 1:<\/p>\n
\tunsi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17314","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17314","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17314"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17314"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17314"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}