In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read<\/p>\n
In qla2x00_status_entry(), the FWI2 status path advances sense_data and
\nshrinks par_sense_len by rsp_info_len:<\/p>\n
\tif (IS_FWI2_CAPABLE(ha)) {
\n\t\tsense_data += rsp_info_len;
\n\t\tpar_sense_len -= rsp_info_len;
\n\t}<\/p>\n
rsp_info_len is a 32-bit value taken directly from the target’s FCP
\nresponse (sf.rsp_data_len), while par_sense_len is the IOCB data area
\nsize (28 bytes for 24xx, 60 bytes for 29xx). A hostile or buggy target
\nreporting an rsp_info_len larger than par_sense_len makes the unsigned
\nsubtraction underflow to a huge value and advances sense_data out of
\nbounds.<\/p>\n
The underflowed par_sense_len then defeats the cap in
\nqla2x00_handle_sense():<\/p>\n
\tif (sense_len > par_sense_len)
\n\t\tsense_len = par_sense_len;
\n\tmemcpy(cp->sense_buffer, sense_data, sense_len);<\/p>\n
so the memcpy reads up to SCSI_SENSE_BUFFERSIZE bytes from the
\nout-of-bounds sense_data pointer, leaking adjacent response-ring\/heap
\nmemory into the command’s sense buffer.<\/p>\n
Clamp rsp_info_len to par_sense_len before the subtraction so
\npar_sense_len can never underflow and sense_data stays within the IOCB
\ndata area. The fix sits before the comp_status switch, covering both
\nqla2x00_handle_sense() call sites.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read<\/p>\n
In qla2x00_status_entry(), the FWI2 status path advances sense_data<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24533","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24533","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24533"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24533"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24533"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}