In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size<\/p>\n
The VP control IOCB selects its target virtual port by setting one bit
\nin vp_idx_map, a fixed 16-byte (128-bit) array in both
\nvp_ctrl_entry_24xx and vp_ctrl_entry_24xx_ext. qla25xx_ctrlvp_iocb()
\ncomputes map = (vp_index – 1) \/ 8 and writes vce->vp_idx_map[map]
\nwithout checking that map stays within the array.<\/p>\n
max_npiv_vports is taken from firmware and only sanitized to a
\nMIN_MULTI_ID_FABRIC-aligned boundary, so it can legitimately be 191 or
\n255, and qla24xx_control_vp() only rejects vp_index >= max_npiv_vports.
\nA vp_index above 128 therefore yields map >= 16 and an out-of-bounds
\nwrite of up to 16 bytes past vp_idx_map, corrupting the trailing IOCB
\nfields (or the adjacent request-ring slot on the 64-byte layout).<\/p>\n
Reject a vp_index that cannot be represented in the IOCB bitmap in
\nqla24xx_control_vp(), and add a defensive ARRAY_SIZE() guard in
\nqla25xx_ctrlvp_iocb() before the write. Adapters that report the usual
\n63 or 127 NPIV vports are unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: qla2xxx: Bound VP index against VP_CTRL IOCB bitmap size<\/p>\n
The VP control IOCB selects its target virtual port by setting one <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28967","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}