In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers<\/p>\n
struct qla_i2c_access carries a 16-bit length field alongside a fixed
\n64-byte buffer:<\/p>\n
\tstruct qla_i2c_access {
\n\t\tuint16_t device, offset, option, length;
\n\t\tuint8_t buffer[0x40];
\n\t} __packed;<\/p>\n
qla2x00_write_i2c() and qla2x00_read_i2c() use the user-supplied
\ni2c->length without any bounds check. i2c is overlaid on a 256-byte
\non-stack buffer and sfp is a 256-byte DMA-pool buffer, so a length up to
\n65535 overruns both:<\/p>\n
– write: memcpy(sfp, i2c->buffer, i2c->length) over-reads the stack and
\n over-writes the sfp heap buffer, and qla2x00_write_sfp() then DMAs
\n i2c->length bytes out of the 256-byte buffer.
\n – read: qla2x00_read_sfp() DMAs i2c->length bytes into the 256-byte sfp,
\n then memcpy(i2c->buffer, sfp, i2c->length) overflows the 64-byte
\n buffer inside the on-stack array.<\/p>\n
A caller holding CAP_SYS_RAWIO can use this to corrupt the heap and the
\nkernel stack. Reject requests whose length exceeds the buffer before any
\ncopy or DMA transfer in both handlers.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Bound i2c->length in I2C bsg handlers<\/p>\n
struct qla_i2c_access carries a 16-bit length field alongside a fixed
\n64-byte<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24551","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24551","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24551"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24551"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24551"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}