In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: bound num_export_targets array for mds info v2\/v3<\/p>\n
ceph_mdsmap_decode() in fs\/ceph\/mdsmap.c reads num_export_targets from
\neach per-mds info record and advances the decode cursor by
\nnum_export_targets * sizeof(u32) without first checking that many bytes
\nremain. The only upper-bound check that catches a runaway cursor
\n(*p > info_end) is gated on info_v >= 4, because info_end is left NULL
\nfor info_v 2 and 3. When the monitor sends an MDS map whose per-mds
\ninfo version is 2 or 3 with an oversized num_export_targets, the cursor
\nmoves past the message front buffer and the later export-targets loop
\ncalls the unchecked ceph_decode_32() on out-of-bounds memory.<\/p>\n
A kernel client processes CEPH_MSG_MDS_MAP from its monitor session
\n(net\/ceph\/mon_client.c dispatches it; fs\/ceph\/super.c routes it to
\nceph_mdsc_handle_mdsmap(), which sets end to the front buffer bound and
\ncalls ceph_mdsmap_decode()). A malicious or compromised monitor, or an
\non-path attacker on an unsigned\/unencrypted messenger session, can
\ntherefore drive an out-of-bounds read in the client kernel; on x86_64
\nwith KASAN it is reported as a slab-out-of-bounds read in
\nceph_mdsmap_decode(). The decoded values land in the internal
\ninfo->export_targets[] array, so the consequence is a kernel
\nout-of-bounds read, not an information leak to the attacker.<\/p>\n
Impact: a malicious or compromised Ceph monitor sending an MDS map with
\na per-mds info version of 2 or 3 and an oversized num_export_targets
\nfield triggers an out-of-bounds read in the CephFS client kernel.<\/p>\n
Add a ceph_decode_need() for the export-targets array before advancing
\nthe cursor, so the bound is enforced for every info_v >= 2, not only
\ninfo_v >= 4. This mirrors the count-then-need idiom already used for
\nm_data_pg_pools later in the same function.<\/p>\n
Compute the export-targets byte count with size_mul() and reuse that
\nchecked length when advancing the cursor, so the attacker-controlled
\nnum_export_targets multiplication fails closed on overflow rather than
\nrelying on the later kcalloc() guard.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: bound num_export_targets array for mds info v2\/v3<\/p>\n
ceph_mdsmap_decode() in fs\/ceph\/mdsmap.c reads num_export_targets from
\neac<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21572","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21572","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}