In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drbd: reject data replies with an out-of-range payload size<\/p>\n
recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of an
\noutstanding read request. The peer-supplied payload length reaches it as
\nthe signed int data_size, and two peer-controlled inputs can make it
\nnegative. With a negotiated data-integrity-alg the digest length is
\nsubtracted first, so a reply whose payload is smaller than the digest
\nunderflows data_size. With no integrity algorithm (the default) data_size
\nis assigned from the unsigned h95\/h100 wire length and drbdd() never
\nbounds it for a payload-carrying command, so a length above INT_MAX casts
\nit negative; this path needs no non-default feature. The bio receive loop
\nthen computes expect = min_t(int, data_size, bv_len), which is negative,
\nand drbd_recv_all_warn(mapped, expect) receives with a size_t of SIZE_MAX
\ninto the first mapped page.<\/p>\n
The sibling receive path read_in_block() is not affected: it uses an
\nunsigned size and rejects it against DRBD_MAX_BIO_SIZE before receiving.
\nReject a data reply whose size is negative after the optional digest
\nsubtraction, covering both triggers.<\/p>\n
Impact: a malicious or man-in-the-middle DRBD peer copies attacker-chosen
\nbytes past a bio page in the receiver, corrupting kernel memory. A node
\nthat reads from its peer (a diskless node, or read-balancing to the peer)
\nis exposed in the default configuration; data-integrity-alg is not
\nrequired.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
drbd: reject data replies with an out-of-range payload size<\/p>\n
recv_dless_read() receives a P_DATA_REPLY from a peer into the bio of <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6729","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6729","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6729"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6729"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}