In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: ccp – Check for page allocation failure correctly in TIO<\/p>\n
Sashiko notes:<\/p>\n
> if __snp_alloc_firmware_pages() returns NULL under memory pressure, is it
\n> safe to pass it directly to page_address()?
\n>
\n> On architectures without HASHED_PAGE_VIRTUAL, page_address(NULL) might
\n> compute a deterministic but invalid, non-zero virtual address. The
\n> subsequent if (tio_status) check would then evaluate to true, and
\n> sev_tsm_init_locked() would dereference the invalid pointer.<\/p>\n
Indeed, page_address(NULL) will return non-NULL garbage here. Fix this by
\nchecking the page allocation itself for NULL, not the resulting virtual
\naddress.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: ccp – Check for page allocation failure correctly in TIO<\/p>\n
Sashiko notes:<\/p>\n
> if __snp_alloc_firmware_pages() returns NULL un<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7356","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}