In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/isert: reject PDUs declaring more data than was received<\/p>\n
isert_recv_done() hands each received PDU to the opcode handlers without
\never looking at wc->byte_len, the number of bytes the HCA actually placed
\nin the receive descriptor. The handlers then copy that many bytes – the
\ndata-segment length the initiator declared in the BHS
\n(ntoh24(hdr->dlength), via the derived unsol_data_len \/ imm_data_len) –
\nout of the fixed-size descriptor:<\/p>\n
isert_handle_iscsi_dataout():
\n sg_copy_from_buffer(sg_start, sg_nents, isert_get_data(rx_desc),
\n unsol_data_len);
\n isert_handle_scsi_cmd():
\n sg_copy_from_buffer(cmd->se_cmd.t_data_sg, sg_nents,
\n isert_get_data(rx_desc), imm_data_len);<\/p>\n
Because the declared length is never checked against wc->byte_len, an
\ninitiator can declare a data segment larger than the bytes it actually
\nsent (and larger than the descriptor) and cause an out-of-bounds read of
\nthe receive buffer.<\/p>\n
Nothing upstream of isert closes this door:<\/p>\n
– __iscsit_check_dataout_hdr() bounds the inbound payload against
\n conn_ops->MaxXmitDataSegmentLength (MXDSL) – a transmit parameter,
\n used here for the inbound check.
\n – iscsi_set_connection_parameters() sets
\n ops->MaxXmitDataSegmentLength = ops->TargetRecvDataSegmentLength;
\n and TARGETRECVDATASEGMENTLENGTH is absent from the min()-clamp list in
\n iscsi_check_acceptor_state(), so the value the initiator declares is
\n adopted verbatim (type range 512..16777215). The initiator effectively
\n raises its own ceiling.
\n – isert never clamps the negotiated value to its own fixed receive
\n descriptor (ISER_RX_SIZE, 9216 bytes), so the target core’s bound and
\n the descriptor size are unrelated.<\/p>\n
The imm_data_len == data_len path is more than an over-read: it aliases
\nthe receive descriptor via sg_set_buf() and passes it to the backend as
\nthe data source for the SCSI WRITE, so an over-declared length causes heap
\ncontents past the descriptor to be written through the backend to the
\nbacking store. The backend is the victim of the oversized scatterlist
\nisert hands it, not the cause; no read-back of the written bytes was
\ndemonstrated.<\/p>\n
Trigger: after login completes (full feature phase), an initiator that has
\ndeclared a large TargetRecvDataSegmentLength and a FirstBurstLength that
\npermits unsolicited\/immediate data sends a PDU whose declared data-segment
\nlength exceeds what was received. With KASAN:<\/p>\n
BUG: KASAN: slab-out-of-bounds in sg_copy_buffer+0x150\/0x1c0
\n Read of size 4096 at addr ffff888109720800 by task kworker\/1:0H\/25
\n Workqueue: ib-comp-wq ib_cq_poll_work
\n Call Trace:
\n sg_copy_buffer+0x150\/0x1c0
\n isert_recv_done+0xba6\/0x2390
\n __ib_process_cq+0xe1\/0x390
\n ib_cq_poll_work+0x46\/0x150<\/p>\n
isert_recv_done+0xba6 resolves to isert_handle_iscsi_dataout()
\n(ib_isert.c:1160), inlined through isert_rx_opcode().<\/p>\n
Validate wc->byte_len against the framing in isert_recv_done() before the
\nPDU reaches any handler, and reinstate the connection if it is short.
\nBecause the test compares without subtracting the header length, it also
\nrejects PDUs shorter than the iSER and iSCSI headers, which would otherwise
\nbe parsed out of stale descriptor contents. The login handler rejects PDUs
\nshorter than ISER_HEADERS_LEN (commit 29e7b925ae6d (“IB\/isert: Reject login
\nPDUs shorter than ISER_HEADERS_LEN”)) but does not bound the declared
\nlength either; that is fixed in the next patch. The data handlers had no
\nlength check at all.<\/p>\n
isert reads the data segment from a fixed offset: isert_get_data()
\nreturns the iSER header plus ISER_HEADERS_LEN and makes no adjustment for
\nan AHS. The bytes the handlers touch are therefore exactly
\n[ISER_HEADERS_LEN, ISER_HEADERS_LEN + dlength), and comparing that sum
\nagainst wc->byte_len bounds precisely the region that is read. An AHS
\nterm would only make the test stricter without bounding anything furth
\n—truncated—<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
IB\/isert: reject PDUs declaring more data than was received<\/p>\n
isert_recv_done() hands each received PDU to the opcode handlers witho<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25823","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25823","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25823"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25823"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25823"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}