In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: wwan: iosm: bound device offsets in the MUX downlink decoder<\/p>\n
mux_dl_adb_decode() walks a chain of aggregated datagram tables using
\noffsets and lengths taken from the modem. first_table_index,
\nnext_table_index, table_length, datagram_index and datagram_length are
\nall device supplied le values. Only first_table_index was checked, and
\nonly for being non zero. The decoder then formed adth = block +
\nadth_index and read the table header and the datagram entries with no
\nbound against the received skb. A modem that reports an index or a
\nlength past the downlink buffer makes the decoder read out of bounds.<\/p>\n
The buffer is IPC_MEM_MAX_DL_MUX_LITE_BUF_SIZE and skb->len is at most
\nthat, so skb->len is the real limit, but none of these in band offsets
\nwere checked against it.<\/p>\n
The table chain is also followed with no forward progress check. The loop
\ntakes the next table from adth->next_table_index and stops only when that
\nreaches zero. A modem can stage two tables that point at each other, so
\nthe loop never ends. It runs in softirq and clones the skb on every pass.<\/p>\n
Validate every device offset and length against skb->len before use.
\nThe block header must fit. Each table header, on entry and after every
\nnext_table_index, must lie inside the skb. The datagram table must fit.
\nEach datagram index and length must stay inside the skb. The header
\npadding must not exceed the datagram length so the receive length does
\nnot wrap. Require each next_table_index to move forward so the chain
\ncannot cycle.<\/p>\n
This was reproduced under KASAN as a slab out of bounds read on a normal
\ndownlink receive once the iosm net device is up.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net: wwan: iosm: bound device offsets in the MUX downlink decoder<\/p>\n
mux_dl_adb_decode() walks a chain of aggregated datagram tables <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6736","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6736","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6736"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6736"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6736"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}