In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
keys: fix out-of-bounds read in keyring_get_key_chunk()<\/p>\n
For description-level chunks keyring_get_key_chunk() advances the read
\npointer by level * sizeof(long) past the inline prefix but only
\nbounds-checks the prefix, so a long enough key description is read past
\nits kmemdup(desc, desc_len + 1) allocation. Compute the full byte
\noffset and bounds-check the description against it before reading.<\/p>\n
The walk only reaches a description-level chunk when two keys collide
\nthrough the hash, x, type and domain_tag chunks, so this is reached from
\nan unprivileged add_key(2) with a crafted pair of same-type keys whose
\nindex hashes collide; KASAN reports a slab-out-of-bounds read.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
keys: fix out-of-bounds read in keyring_get_key_chunk()<\/p>\n
For description-level chunks keyring_get_key_chunk() advances the read
\npoi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-8864","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/8864","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=8864"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=8864"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=8864"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}