In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dm-log: fix a bitset_size overflow on 32bit machines<\/p>\n
Commit c20e36b7631d (“dm log: fix out-of-bounds write due to
\nregion_count overflow”) made sure that region_count could fit in an
\nunsigned int. But the bitmap memory isn’t allocated based on
\nregion_count. It uses bitset_size (a size_t variable). The first step of
\ncalculating bitset_size is to set it to region_count, rounded up to a
\nmultiple of BITS_PER_LONG. If region_size is less than BITS_PER_LONG
\nsmaller than UINT_MAX, it will get rounded up to 2^32. On a 32bit
\narchitecture, this will make bitset_size wrap around to 0 and fail,
\ndespite region_count being valid.<\/p>\n
Since bitset_size gets divided by 8, it can hold any valid region_count.
\nIt just needs a special case to handle the rollover. If it is 0, the
\nvalue rolled over, and bitset size should be set to the number of bytes
\nneeded to hold 2^32 bits.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dm-log: fix a bitset_size overflow on 32bit machines<\/p>\n
Commit c20e36b7631d (“dm log: fix out-of-bounds write due to
\nregion_count ove<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6774","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6774","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6774"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6774"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6774"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}