In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: atm: usbatm: fix invalid ci_range initialization<\/p>\n
syzbot reported a shift-out-of-bounds in __vcc_connect():<\/p>\n
UBSAN: shift-out-of-bounds in net\/atm\/common.c:382:32
\n shift exponent -1 is negative
\n CPU: 0 UID: 0 PID: 5987 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
\n Hardware name: Google Compute Engine\/Google Compute Engine, BIOS Google 08\/05\/2026
\n Call Trace:<\/p>\n
dump_stack_lvl+0xe8\/0x150 lib\/dump_stack.c:120
\n ubsan_epilogue+0xa\/0x30 lib\/ubsan.c:233
\n __ubsan_handle_shift_out_of_bounds+0x36d\/0x400 lib\/ubsan.c:494
\n __vcc_connect+0x14b4\/0x19c0 net\/atm\/common.c:382
\n vcc_connect+0x328\/0x8f0 net\/atm\/common.c:498
\n pvc_bind+0x272\/0x380 net\/atm\/pvc.c:52
\n __sys_bind+0x2e3\/0x410 net\/socket.c:1976
\n __x64_sys_bind+0x7a\/0x90 net\/socket.c:1979
\n …<\/p>\n
ATM device ci_range fields (vpi_bits and vci_bits) represent the
\nnumber of bits supported for VPI and VCI addressing on the device.
\nnet\/atm\/common.c directly uses these fields as bit shift counts:
\n vpi >> dev->ci_range.vpi_bits
\n vci >> dev->ci_range.vci_bits
\n 1 <dev->ci_range.vpi_bits
\n 1 <dev->ci_range.vci_bits<\/p>\n
usbatm_atm_init() sets ci_range.vpi_bits and ci_range.vci_bits to
\nATM_CI_MAX (-1), which is defined in as a
\nsentinel value for userspace ATM_SETCIRANGE requests, not a valid bit
\ncount. Shifting by -1 is undefined behavior and triggers UBSAN
\nwarnings.<\/p>\n
ATM UNI cell headers allow up to 8 bits for VPI (0..255) and 16 bits
\nfor VCI (0..65535). Initialize vpi_bits to 8 and vci_bits to 16, as
\ndone by solos-pci.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
usb: atm: usbatm: fix invalid ci_range initialization<\/p>\n
syzbot reported a shift-out-of-bounds in __vcc_connect():<\/p>\n
UBSAN: shift-ou<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25464","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}