In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools<\/p>\n
nvme_setup_descriptor_pools() indexes dev->descriptor_pools[] using the
\nnuma_node forwarded from hctx->numa_node by its single caller,
\nnvme_init_hctx_common(). On a non-NUMA kernel hctx->numa_node is
\nNUMA_NO_NODE (-1). Because the parameter was declared ‘unsigned’, the
\nvalue becomes UINT_MAX and the index walks off the array (sized to
\nnr_node_ids), faulting during nvme_alloc_ns() and leaving the namespace
\nwithout a \/dev node.<\/p>\n
Reproduces on any NVMe controller probed by a CONFIG_NUMA=n kernel:<\/p>\n
BUG: unable to handle page fault for address: ffff889101603d38
\n RIP: 0010:nvme_init_hctx_common+0x5a\/0x190 [nvme]
\n Call Trace:
\n nvme_init_hctx+0x10\/0x20 [nvme]
\n nvme_alloc_ns+0x9e\/0xa10 [nvme_core]
\n nvme_scan_ns+0x301\/0x3b0 [nvme_core]
\n nvme_scan_ns_async+0x23\/0x30 [nvme_core]<\/p>\n
Switch the parameter to int and fall back to node 0 when it is
\nNUMA_NO_NODE; node 0 is always present.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
nvme-pci: fix out-of-bounds access in nvme_setup_descriptor_pools<\/p>\n
nvme_setup_descriptor_pools() indexes dev->descriptor_pools[] us<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7334","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7334","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7334"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7334"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7334"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}