In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: s390: Fix length check __import_wp_info()<\/p>\n
struct kvm_hw_breakpoint::len is a __u64 that is fully controlled by user
\nspace. This is then assigned to wp_info->len, which is an int. The bounds
\ncheck is done on the truncated value while the allocation uses the
\nuntruncated one:<\/p>\n
\twp_info->len = bp_data->len;
\n\t[…]
\n\tif (wp_info->len len > MAX_WP_SIZE)
\n\t\treturn -EINVAL;<\/p>\n
\twp_info->old_data = kmalloc(bp_data->len, GFP_KERNEL_ACCOUNT);<\/p>\n
Use the validated value for the allocation as intended. Without this
\nfix userspace can trigger >4GB allocations which will fail and result
\nin a WARN due to MAX_PAGE_ORDER.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: s390: Fix length check __import_wp_info()<\/p>\n
struct kvm_hw_breakpoint::len is a __u64 that is fully controlled by user
\nspace. Th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24613","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}