In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Fix integer overflow in mr_check_range() leading to OOB access<\/p>\n
mr_check_range() validates that [iova, iova+length) falls within the
\nregistered MR range using wraparound-prone arithmetic:<\/p>\n
if (iova ibmr.iova ||
\n iova + length > mr->ibmr.iova + mr->ibmr.length)<\/p>\n
A remote peer can craft an RDMA-Write\/Read RETH so that iova + length
\nwraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the
\ncheck. rxe_mr_iova_to_index() then computes a huge index (int idx, only
\nguarded by WARN_ON) and rxe_mr_copy_xarray() dereferences
\nmr->page_info[huge], causing an out-of-bounds read\/write and a kernel
\noops that is triggerable by an unauthenticated remote peer.<\/p>\n
Rewrite the check in overflow-safe form; the first two clauses guarantee
\nthat the subsequent subtractions do not underflow:<\/p>\n
if (iova ibmr.iova ||
\n length > mr->ibmr.length ||
\n iova – mr->ibmr.iova > mr->ibmr.length – length)<\/p>\n
With the fix, mr_check_range() returns -EINVAL for the crafted iova and
\nthe responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
RDMA\/rxe: Fix integer overflow in mr_check_range() leading to OOB access<\/p>\n
mr_check_range() validates that [iova, iova+length) falls<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33434","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33434","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33434"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33434"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33434"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}