In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Zero SFP DMA buffer in FRU\/I2C bsg handlers<\/p>\n
The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE
\n(256-byte) bounce buffer obtained from dma_pool_alloc(), which does not
\nzero the allocation. They initialize only a few leading bytes before
\nhanding the buffer to qla2x00_write_sfp().<\/p>\n
qla2x00_write_sfp() can override the transfer length with a user-supplied
\nvalue:<\/p>\n
\tif (len == 1)
\n\t\topt |= BIT_0;
\n\tif (opt & BIT_0)
\n\t\tlen = *sfp;<\/p>\n
*sfp is the first byte of the (user-controlled) payload, so len can grow
\nup to 255. The device then DMA-reads len bytes from the 256-byte pool
\nbuffer. Since only a small prefix was written
\n(e.g. MAX_FRU_SIZE == 36 bytes for a FRU version, one byte for a FRU
\nstatus register), the hardware reads past the initialized region and
\nwrites up to ~219 bytes of stale DMA-pool heap memory to the device
\nflash.<\/p>\n
Allocate the buffer with dma_pool_zalloc() in all five FRU\/I2C handlers
\nso any bytes beyond the initialized data are zero rather than stale heap
\ncontents.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Zero SFP DMA buffer in FRU\/I2C bsg handlers<\/p>\n
The FRU and I2C bsg handlers stage their transfer in a DMA_POOL_SIZE
\n(2<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24552","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24552","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24552"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24552"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24552"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}