In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: ccp – Fix snp_filter_reserved_mem_regions() off-by-one<\/p>\n
Sashiko notes:<\/p>\n
> regarding the bounds check in snp_filter_reserved_mem_regions()
\n> called via walk_iomem_res_desc(): does the check
\n> if ((range_list->num_elements * 16 + 8) > PAGE_SIZE)
\n> allow an off-by-one heap buffer overflow?
\n>
\n> If range_list->num_elements is 255, 255 * 16 + 8 = 4088, which is Writing range->base (8 bytes) fills 4088-4095, but writing range->page_count
\n> (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated
\n> PAGE_SIZE buffer.<\/p>\n
Fix this by accounting for the entry about to be written to, in addition to
\nthe entries that are already allocated.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
crypto: ccp – Fix snp_filter_reserved_mem_regions() off-by-one<\/p>\n
Sashiko notes:<\/p>\n
> regarding the bounds check in snp_filter_reserved<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7358","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7358","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7358"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7358"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7358"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}