In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing<\/p>\n
xdr_buf_to_bvec() writes a bio_vec into the caller’s array before
\ntesting whether that slot is in range, and the head branch performs
\nthe store with no check at all. When the caller’s budget is exactly
\nused up, the next store lands one element past the end of the array.
\nThe overflow label returns count – 1, which masks the surplus store
\nbut cannot undo it.<\/p>\n
rq_bvec, the array passed by nfsd_vfs_write(), is allocated to
\nexactly rq_maxpages entries with no slack. The OOB store can land in
\nadjacent slab memory; the bv_len and bv_offset fields written there
\nare derived from client-supplied RPC payload sizes.<\/p>\n
Move the in-range check ahead of the store in the head, page-loop,
\nand tail branches. With the check at the top of each sequence, count
\nis incremented only after a successful store, so the overflow label
\ncan return count directly.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
SUNRPC: Bound-check xdr_buf_to_bvec() stores before writing<\/p>\n
xdr_buf_to_bvec() writes a bio_vec into the caller’s array before
\ntest<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6843","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6843","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6843"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6843"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6843"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}