In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: block: Fix zones_cond out-of-bounds write on zone report<\/p>\n
blk_revalidate_disk_zones() sizes the zones_cond array from the disk
\ncapacity and zone size, but the index used by blk_revalidate_zone_cond()
\ncomes from the device-driven report_zones() walk and is never checked
\nagainst the array size. A device reporting more zones than fit the array
\nmakes blk_zone_set_cond() write out of bounds.<\/p>\n
One way to reach this is a zone count exceeding 32 bits: both
\nblk_revalidate_zone_args.nr_zones and struct zoned_disk_info.nr_zones are
\nunsigned int, so a disk advertising more than UINT_MAX zones (e.g. 2^32 +
\n1024 zones of one 512-byte logical block) gets its zone count truncated to
\na small value, undersizing the array while the report walk keeps counting
\nupward.<\/p>\n
Check the index against the array size before storing the zone condition,
\nand refuse to revalidate when the zone count does not fit 32 bits.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: block: Fix zones_cond out-of-bounds write on zone report<\/p>\n
blk_revalidate_disk_zones() sizes the zones_cond array from the dis<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41107","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}