In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dm-pcache: validate seg_id fields from persistent memory<\/p>\n
cache_pos_decode(), cache_key_decode() and the last-kset branches of
\ncache_replay(), the writeback worker and the GC worker take a cache
\nsegment id from the cache device metadata and index cache->segments[]
\nwith it without checking it against cache->n_segs. That metadata is only
\nCRC-protected with a fixed public seed, so whoever supplies the cache
\ndevice on a table load (CAP_SYS_ADMIN) controls the id; an out-of-range
\nvalue forms a wild pcache_cache_segment pointer that is dereferenced and
\nwritten through — an out-of-bounds read and write driven by on-disk data.<\/p>\n
Add cache_seg_id_valid() and reject an out-of-range id at each decode
\nsite, failing the operation with -EIO instead of indexing past the array.
\nBound the id against the initialized-segment count (cache_info.n_segs)
\nrather than the physical device total. A forged cache_info.n_segs below
\nseg_num otherwise leaves segments[cache_info.n_segs..seg_num) as zeroed
\nstructs whose data pointer is NULL, so a forged id in that window would
\nstill be dereferenced. A later patch guarantees cache_info.n_segs <=
\nseg_num, and a driver-created cache sets the two equal, so valid images
\nare unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dm-pcache: validate seg_id fields from persistent memory<\/p>\n
cache_pos_decode(), cache_key_decode() and the last-kset branches of
\ncach<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-26058","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/26058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=26058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=26058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=26058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}