In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mctp: serial: handle zero-length frames to prevent rx buffer overflow<\/p>\n
The MCTP serial receive state machine reads a frame length byte in
\nmctp_serial_push_header() case 2 and validates it upper-bound-only:<\/p>\n
\tif (c > MCTP_SERIAL_FRAME_MTU) {
\n\t\tdev->rxstate = STATE_ERR;
\n\t} else {
\n\t\tdev->rxlen = c;
\n\t\tdev->rxpos = 0;
\n\t\tdev->rxstate = STATE_DATA;
\n\t\t…
\n\t}<\/p>\n
A length of zero passes this check, so rxlen is set to 0 and the state
\nmachine advances to STATE_DATA. In mctp_serial_push() STATE_DATA, the
\nincoming byte is stored and rxpos incremented before the terminator is<\/p>\n
\tdev->rxbuf[dev->rxpos] = c;
\n\tdev->rxpos++;
\n\tdev->rxstate = STATE_DATA;
\n\tif (dev->rxpos == dev->rxlen) {
\n\t\tdev->rxpos = 0;
\n\t\tdev->rxstate = STATE_TRAILER;
\n\t}<\/p>\n
With rxlen == 0 the “rxpos == rxlen” terminator can never fire (rxpos is
\nalready 1 on the first data byte), so subsequent bytes are written past
\nthe end of the fixed 74-byte rxbuf, which is the last member of the
\nnetdev private area. Every following data byte is an attacker-controlled
\n1-byte out-of-bounds heap write, and the overflow continues until a
\nframe (0x7e) or escape byte resets the parser — effectively unbounded.<\/p>\n
Reaching this requires CAP_NET_ADMIN to attach the N_MCTP line
\ndiscipline and bring the resulting mctpserialN netdev up, after which
\nthe bytes arrive via the tty receive path.<\/p>\n
Route a zero-length frame straight to STATE_TRAILER instead of
\nSTATE_DATA. The trailer\/framing bytes are still consumed, and the frame
\nresolves to a zero-length skb that the MCTP core rejects; the parser
\nnever enters STATE_DATA with rxlen == 0, so the out-of-bounds write can
\nno longer occur.<\/p>\n
KASAN, on a frame of 0x7e 0x01 0x00 followed by data bytes (before this
\nchange):<\/p>\n
UBSAN: array-index-out-of-bounds in drivers\/net\/mctp\/mctp-serial.c:370
\n index 74 is out of range for type ‘u8 [74]’
\n BUG: KASAN: slab-out-of-bounds in mctp_serial_tty_receive_buf
\n Write of size 1 at addr … by task kworker\/u16:0
\n mctp_serial_tty_receive_buf
\n tty_ldisc_receive_buf
\n flush_to_ldisc
\n Allocated by task 152:
\n alloc_netdev_mqs
\n mctp_serial_open<\/p>\n
v2: route zero-length frames to STATE_TRAILER instead of STATE_ERR so
\n the trailer\/framing bytes are still consumed (Jeremy Kerr).<\/p>\n
Found by 0sec automated security-research tooling (https:\/\/0sec.ai).<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mctp: serial: handle zero-length frames to prevent rx buffer overflow<\/p>\n
The MCTP serial receive state machine reads a frame length b<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5337","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}