In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: fix two unsafe bare decodes in decode_lockers()<\/p>\n
decode_lockers() in cls_lock_client.c contains two bare decode operations
\nthat allow a malicious or compromised OSD to trigger slab-out-of-bounds
\nreads:<\/p>\n
1. ceph_decode_32(p) at the num_lockers field has no preceding bounds
\n check. ceph_start_decoding() accepts struct_len=0 as valid — the
\n internal ceph_decode_need(p, end, 0, bad) always passes — so when an
\n OSD sends struct_len=0, ceph_start_decoding() returns success with
\n p == end. The immediately following bare ceph_decode_32(p) then reads
\n 4 bytes past the validated buffer boundary. The garbage value is
\n passed directly to kzalloc_objs() as the locker count.<\/p>\n
The sibling function decode_watchers() in osd_client.c already uses
\n ceph_decode_32_safe() after its own ceph_start_decoding() call.
\n decode_lockers() was the only site using the bare variant.<\/p>\n
2. ceph_decode_8(p) after the decode_locker() loop has no preceding
\n bounds check. If an OSD crafts num_lockers such that the loop
\n advances p exactly to end, the subsequent bare ceph_decode_8(p) reads
\n one byte past the validated buffer boundary. The result is passed
\n directly into *type, which is used as a lock type discriminator by
\n callers, giving an OSD-controlled one-byte OOB read with direct
\n influence over the lock type field.<\/p>\n
Fix both by replacing bare operations with their safe variants:
\n ceph_decode_32(p) -> ceph_decode_32_safe(p, end, *num_lockers,
\n err_inval)
\n ceph_decode_8(p) -> ceph_decode_8_safe(p, end, *type,
\n err_free_lockers)<\/p>\n
The goto targets differ intentionally:
\n err_inval: is a new label returning -EINVAL directly. It is used for
\n the pre-allocation failure path where *lockers is not yet allocated
\n and must not be passed to ceph_free_lockers().<\/p>\n
err_free_lockers: is the existing label. It is used for the
\n post-allocation failure path where *lockers is allocated and must
\n be freed.<\/p>\n
ret is set to -EINVAL before ceph_decode_8_safe() so that
\nerr_free_lockers returns the correct error code on bounds violation.
\nWithout this, err_free_lockers would return a stale ret value (0 from
\nthe successful decode_locker() loop), silently swallowing the error.<\/p>\n
-EINVAL is correct for both failure paths. The data received from the
\nOSD is structurally malformed. -ENOMEM would misrepresent the failure
\nclass to callers and to stable@ backporters triaging error paths.<\/p>\n
Attacker model: a malicious or compromised OSD in a multi-tenant Ceph
\ndeployment can trigger this against any kernel client that issues the
\nlock.get_info class method (e.g. during RBD exclusive lock acquisition).<\/p>\n
[ idryomov: trim changelog, formatting ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
libceph: fix two unsafe bare decodes in decode_lockers()<\/p>\n
decode_lockers() in cls_lock_client.c contains two bare decode operations<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5191","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5191","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5191"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5191"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5191"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}