In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Validate Read chunk positions before reconstruction<\/p>\n
The RPC\/RDMA Read chunk position field is supplied by the remote
\nclient and stored verbatim in the parsed chunk list.
\nxdr_count_read_segments() checks only 4-byte alignment; it never
\ncompares the position against the received inline body length.<\/p>\n
In the single-chunk path, svc_rdma_read_complete_one() splits the
\nhead and tail kvecs at ch_position. A position past the inline
\nbody underflows the tail length, exposing adjacent slab memory to
\nthe upper XDR decoder.<\/p>\n
In the multi-chunk path, svc_rdma_read_multiple_chunks() computes
\ngap lengths between chunks as unsigned subtractions from
\nch_position. Overlapping Read chunks cause these subtractions to
\nunderflow. A final position past the inline body likewise
\nunderflows the trailing gap length. svc_rdma_copy_inline_range()
\nthen copies past the receive buffer into request pages that are
\nreturned to the client through the Reply channel.<\/p>\n
Bound inline-range copies in svc_rdma_copy_inline_range() against
\nthe decoded inline RPC body saved in rc_saved_arg. Reject a
\nsingle Read chunk positioned beyond that body, and reject
\nmulti-chunk lists where accumulated read bytes exceed the next
\nchunk’s position. Apply the same position and overlap checks in
\nthe call-chunk interleaving path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Validate Read chunk positions before reconstruction<\/p>\n
The RPC\/RDMA Read chunk position field is supplied by the remote
\nclie<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21448","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21448","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21448"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21448"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21448"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}