In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]<\/p>\n
The FC BSG transport allocates job->request via memdup_user() using the
\nexact user-supplied request_len. For FC_BSG_HST_VENDOR,
\nfc_bsg_host_dispatch() only guarantees request_len covers msgcode and
\nvendor_id; it does not account for the vendor_cmd[] flexible array.<\/p>\n
qla2xxx then reads the command selector vendor_cmd[0] and, in several
\nsub-handlers, vendor_cmd[1]\/[2] or structures overlaid on the vendor
\ncommand area without verifying request_len. A caller holding
\nCAP_SYS_RAWIO can submit a short request whose vendor_id matches the
\nhost, triggering out-of-bounds heap reads (KASAN-detectable, and able to
\nmis-select a command or panic).<\/p>\n
Add a central guard in qla2x00_process_vendor_specific() so the selector
\nis always in bounds, restrict the early vendor_cmd[0] read in
\nqla24xx_bsg_request() to sufficiently long vendor messages, and add
\nrequest_len checks to the sub-handlers that read further:
\nqla24xx_proc_fcp_prio_cfg_cmd(), qla2x00_process_loopback(),
\nqla84xx_reset(), qla84xx_updatefw(), qla2x00_read_optrom(),
\nqla2x00_update_optrom(), qlafx00_mgmt_cmd() and
\nqla28xx_validate_flash_image().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Validate BSG request_len before reading vendor_cmd[]<\/p>\n
The FC BSG transport allocates job->request via memdup_user() <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28961","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28961","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28961"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28961"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28961"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}