In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()<\/p>\n
In paste_selection(), the loop copies min_t(unsigned int,
\nvc_sel.buf_len – pasted,tty->receive_room) bytes per iteration into
\ntty_ldisc_receive_buf() and increments pasted += count.<\/p>\n
Because the selection mutex (vc_sel.lock) is dropped inside the loop
\nWhenever the line discipline buffer fills up and paste_selection()
\nsleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl
\ncan replace vc_sel.buffer with a shorter selection and reduce
\nvc_sel.buf_len below pasted.<\/p>\n
When paste_selection() resumes, vc_sel.buf_len – pasted underflows as an
\nunsigned integer to a large positive value, causing
\ntty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read
\nup to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.<\/p>\n
Fix this by terminating the loop when pasted >= vc_sel.buf_len.<\/p>\n
Kernel stack trace (Linux 7.3.0-rc3):
\n ==================================================================
\n BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01\/0x1650
\n Read of size 4094 at addr ffff888101c58010 by task kworker\/u17:1\/65
\n Workqueue: events_unbound flush_to_ldisc
\n Call Trace:<\/p>\n
dump_stack_lvl+0x70\/0xa0
\n print_report+0x153\/0x4c6
\n kasan_report+0xf1\/0x120
\n kasan_check_range+0x11c\/0x200
\n __asan_memcpy+0x29\/0x70
\n n_tty_receive_buf_common+0xa01\/0x1650
\n tty_ldisc_receive_buf+0x66\/0x110
\n tty_port_default_receive_buf+0x6b\/0xb0
\n flush_to_ldisc+0x1b4\/0x410
\n process_one_work+0x6ff\/0x1110
\n worker_thread+0x4a8\/0xb70
\n kthread+0x307\/0x3e0
\n ret_from_fork+0x3ed\/0x680<\/p>\n
==================================================================<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()<\/p>\n
In paste_selection(), the loop copies min_t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41311","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}