In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: validate banner payload length<\/p>\n
When parsing the Ceph messenger v2 protocol banner, the `payload_len` field
\nis decoded from the banner prefix. If a client sends a banner with a
\n`payload_len` of 0, the kernel sets up a 0-length socket read. This
\nviolates an invariant in the state machine, triggering a warning in
\n`populate_in_iter()`:<\/p>\n
————[ cut here ]————
\n!iov_iter_count(&con->v2.in_iter)
\nWARNING: net\/ceph\/messenger_v2.c:3129 at populate_in_iter
\nnet\/ceph\/messenger_v2.c:3129 [inline], CPU#1: kworker\/1:3\/5070
\nWARNING: net\/ceph\/messenger_v2.c:3129 at ceph_con_v2_try_read+0x6634\/0x6810
\nnet\/ceph\/messenger_v2.c:3159, CPU#1: kworker\/1:3\/5070
\n…
\nCall Trace:<\/p>\n
ceph_con_workfn+0x1f5\/0x14a0 net\/ceph\/messenger.c:1575
\n process_one_work kernel\/workqueue.c:3322 [inline]
\n process_scheduled_works+0xa8e\/0x14e0 kernel\/workqueue.c:3405
\n worker_thread+0xa47\/0xfb0 kernel\/workqueue.c:3486
\n kthread+0x388\/0x470 kernel\/kthread.c:436
\n ret_from_fork+0x514\/0xb70 arch\/x86\/kernel\/process.c:158
\n ret_from_fork_asm+0x1a\/0x30 arch\/x86\/entry\/entry_64.S:245<\/p>\n
According to the msgr2 protocol specification, the banner payload is
\nexpected to contain at least two 64-bit integers (`server_feat` and
\n`server_req_feat`). Therefore, `payload_len` must be at least 16 bytes.<\/p>\n
Fix this by adding a check in `process_banner_prefix()` to reject a
\n`payload_len` smaller than 16 bytes. This prevents the 0-length read and
\ncorrectly aborts the connection with a protocol error.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: validate banner payload length<\/p>\n
When parsing the Ceph messenger v2 protocol banner, the `payload_len` field
\nis decoded fro<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25476","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25476","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25476"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25476"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25476"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}