In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: carry oversized SMC-Rv2 LLC messages in the queue entry<\/p>\n
smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part
\nof a v2 message that does not fit into the 44-byte union smc_llc_msg, and
\nboth bound themselves by the size of the buffer it landed in, not by what
\narrived. On a link with a shared v2 receive buffer a 44-byte
\nDELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in whatever an
\nearlier message left in lgr->wr_rx_buf_v2, and passes each of them to
\nsmc_rtoken_delete(). One of those 255 matched a registered rtoken and
\ndeleted it. An ADD_LINK on such a link installs up to 255 rtokens from
\nthe same bytes.<\/p>\n
Copy the tail into the queue entry, so its length is the length of the
\nmessage that arrived, and declare the rkeys that fit inline as a member of
\nthe union instead of reaching them through a cast. The same
\nDELETE_RKEY_V2 now processes the 9 rkeys it carries. The copy is limited
\nto the longest tail the two functions can read, so the peer does not pick
\nthe size of the entry.<\/p>\n
The bound the previous patch placed on links without a shared v2 receive
\nbuffer is no longer needed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/smc: carry oversized SMC-Rv2 LLC messages in the queue entry<\/p>\n
smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21318","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21318","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}