In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()<\/p>\n
ceph_handle_caps() reads snap_trace_len from the wire-format
\nceph_mds_caps header and uses it unconditionally to build a fake
\nend pointer (snaptrace + snaptrace_len) that is later handed to
\nceph_update_snap_trace() in the CEPH_CAP_OP_IMPORT case:<\/p>\n
snaptrace = h + 1;
\n snaptrace_len = le32_to_cpu(h->snap_trace_len);
\n p = snaptrace + snaptrace_len;
\n …
\n case CEPH_CAP_OP_IMPORT:
\n if (snaptrace_len) {
\n …
\n if (ceph_update_snap_trace(mdsc, snaptrace,
\n snaptrace + snaptrace_len,
\n false, &realm)) { … }<\/p>\n
ceph_update_snap_trace() then decodes a struct ceph_mds_snap_realm
\nfrom snaptrace using ceph_decode_need(&p, e, sizeof(*ri), bad)
\nwith the attacker-supplied fake end e == snaptrace + snaptrace_len.
\nWith snaptrace_len == 0xFFFFFFFF the bound check is trivially
\nsatisfied, ri = p reads sizeof(struct ceph_mds_snap_realm) past
\nthe legitimate msg->front buffer, and ri->num_snaps \/
\nri->num_prior_parent_snaps then drive further out-of-bounds
\nreads of the encoded snap arrays.<\/p>\n
The eleven msg_version >= 2 .. msg_version >= 12 decoder blocks
\nabove the op switch each catch this OOB through their
\nceph_decode_*_safe() \/ ceph_decode_need() helpers, but they sit
\nbehind a hdr.version-gated if, so a malicious or compromised
\nMDS that sets msg->hdr.version = 1 reaches the IMPORT path with
\nno version-gated decoder having validated snap_trace_len. The
\nshape has been present since ceph_handle_caps() was introduced.<\/p>\n
Validate snap_trace_len against the message front buffer before
\nconsuming it, using the canonical ceph_decode_need() \/ ceph_has_room()
\nhelper. The helper bounds the length with subtraction (n = p) rather than pointer addition, so it is wrap-safe
\nfor the attacker-controlled u32 length on 32-bit builds where
\np + snap_trace_len could overflow the address space. This matches the
\nrest of the ceph decode path (e.g. the pool_ns_len check a few lines
\nbelow), and the existing goto bad cleanup already covers this exit
\npath.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()<\/p>\n
ceph_handle_caps() reads snap_trace_len from the wire-for<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5364","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5364","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}