In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write<\/p>\n
resp_report_zones() sizes the reply buffer from the CDB allocation
\nlength. The v3 fix rounds alloc_len up with ALIGN() before deriving the
\ndescriptor count:<\/p>\n
\trep_max_zones = (ALIGN((u64)alloc_len, RZONES_DESC_HD) –
\n\t\t\t RZONES_DESC_HD) >> ilog2(RZONES_DESC_HD);
\n\tarr_len = (u64)RZONES_DESC_HD * (rep_max_zones + 1);<\/p>\n
For alloc_len in 0xFFFFFFC1..0xFFFFFFFF, ALIGN() rounds up to
\n0x100000000, so arr_len is 4 GB. On 32-bit, kzalloc()’s size_t is 32-bit
\nand truncates 0x100000000 to 0; kzalloc(0) returns ZERO_SIZE_PTR, which
\npasses the !arr check, and desc = arr + 64 is then dereferenced in the
\nloop -> out-of-bounds write \/ panic.<\/p>\n
Clamp rep_max_zones to devip->nr_zones. The loop already stops at
\nsdebug_capacity (after nr_zones zones), so a report can never hold more
\nthan nr_zones descriptors; the clamp does not change the report, it only
\nbounds arr_len to (nr_zones + 1) * RZONES_DESC_HD, a real device
\nproperty that can never reach 0x100000000.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write<\/p>\n
resp_report_zones() sizes the reply buffer from the CDB allocatio<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7456","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7456","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7456"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7456"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7456"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}