In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cxl\/features: bound fwctl command payload to the input buffer<\/p>\n
fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd->in_len)
\nand passes inbuf and in_len to ->fw_rpc(). The CXL callback cxlctl_fw_rpc()
\nignores in_len and never checks the user-controlled op_size against it.<\/p>\n
cxlctl_set_feature() bounds op_size only from below
\n(op_size hdr)) and then reads op_size – sizeof(hdr)
\nbytes from feat_in->feat_data via cxl_set_feature(). With a small in_len
\nand a large op_size the first memcpy() already reads past the
\nkvzalloc(in_len) buffer; the out-of-bounds bytes are placed in the mailbox
\npayload and sent to the device, and a large enough op_size can walk into
\nunmapped memory and oops the kernel. The Get paths pin op_size to a fixed
\nsize but likewise read the input struct without checking in_len.<\/p>\n
Reject, at the single dispatch point, any request whose fixed header plus
\nop_size does not fit in the copied-in buffer. The lower-bound test guards
\nthe subtraction and ensures op_size was copied in before it is read.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
cxl\/features: bound fwctl command payload to the input buffer<\/p>\n
fwctl_cmd_rpc() copies cmd->in_len bytes into inbuf = kvzalloc(cmd-><\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21493","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21493","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21493"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21493"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21493"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}