In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: validate OSD extent maps before cursor advance<\/p>\n
net\/ceph\/osd_client.c:osd_sparse_read() validates that the sparse-read
\ndata length matches the summed extent lengths, but it does not validate
\nthat each OSD-supplied extent is monotonic and lies inside the original
\nrequest range. A malformed authenticated OSD reply can advertise a
\nfar-forward nonzero extent offset with a matching data length and make
\nthe client advance the message-data cursor beyond the request buffer.
\nThis reaches the BUG_ON(!*length) assertion in ceph_msg_data_next() from
\nthe client receive path.<\/p>\n
Impact: A malicious or compromised authenticated Ceph OSD peer can crash
\na kernel Ceph client via a malformed sparse-read reply.<\/p>\n
Reject sparse extent maps that overflow, move backwards, overlap, or
\nextend outside the original sparse-read request before advancing the
\ncursor.<\/p>\n
[ idryomov: perform sparse_extent_map_valid() check a bit earlier,
\n in CEPH_SPARSE_READ_DATA_LEN instead of CEPH_SPARSE_READ_DATA_PRE
\n state ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: validate OSD extent maps before cursor advance<\/p>\n
net\/ceph\/osd_client.c:osd_sparse_read() validates that the sparse-read
\ndat<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21579","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21579","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21579"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21579"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21579"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}