In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Reject Read lists that exceed the page budget<\/p>\n
Individual Read segment lengths are validated at decode time, but
\nnothing prevents a requester from sending multiple segments whose
\ncumulative length exceeds the rq_pages array budget. When one
\nsegment fills the page array exactly, the runtime guard in
\nsvc_rdma_build_read_segment() is bypassed because len reaches zero.
\nA subsequent segment then accesses the NULL sentinel slot at
\nrq_pages[rq_maxpages], resulting in a NULL pointer dereference during
\nDMA mapping.<\/p>\n
Accumulate pages across all Read segments and reject the message at
\ndecode time when the total would overflow the page budget.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
svcrdma: Reject Read lists that exceed the page budget<\/p>\n
Individual Read segment lengths are validated at decode time, but
\nnothing p<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21450","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}