| { |
| "containers": { |
| "cna": { |
| "providerMetadata": { |
| "orgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038" |
| }, |
| "descriptions": [ |
| { |
| "lang": "en", |
| "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Address an integer overflow\n\nDan Carpenter reports:\n> Commit 78147ca8b4a9 (\"svcrdma: Add a \"parsed chunk list\" data\n> structure\") from Jun 22, 2020 (linux-next), leads to the following\n> Smatch static checker warning:\n>\n>\tnet/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()\n>\twarn: potential user controlled sizeof overflow 'segcount * 4 * 4'\n>\n> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c\n> 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)\n> 489 {\n> 490 u32 segcount;\n> 491 __be32 *p;\n> 492\n> 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))\n> ^^^^^^^^\n>\n> 494 return false;\n> 495\n> 496 /* A bogus segcount causes this buffer overflow check to fail. */\n> 497 p = xdr_inline_decode(&rctxt->rc_stream,\n> --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p));\n>\n>\n> segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will\n> have an integer overflow and some those values will be accepted by\n> xdr_inline_decode()." |
| } |
| ], |
| "affected": [ |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "unaffected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c" |
| ], |
| "versions": [ |
| { |
| "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2", |
| "lessThan": "21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2", |
| "lessThan": "c1f8195bf68edd2cef0f18a4cead394075a54b5a", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2", |
| "lessThan": "838dd342962cef4c320632a5af48d3c31f2f9877", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2", |
| "lessThan": "4cbc3ba6dc2f746497cade60bcbaa82ae3696689", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2", |
| "lessThan": "e5c440c227ecdc721f2da0dd88b6358afd1031a7", |
| "status": "affected", |
| "versionType": "git" |
| }, |
| { |
| "version": "78147ca8b4a9b6cf0e597ddd6bf17959e08376c2", |
| "lessThan": "3c63d8946e578663b868cb9912dac616ea68bfd0", |
| "status": "affected", |
| "versionType": "git" |
| } |
| ] |
| }, |
| { |
| "product": "Linux", |
| "vendor": "Linux", |
| "defaultStatus": "affected", |
| "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", |
| "programFiles": [ |
| "net/sunrpc/xprtrdma/svc_rdma_recvfrom.c" |
| ], |
| "versions": [ |
| { |
| "version": "5.11", |
| "status": "affected" |
| }, |
| { |
| "version": "0", |
| "lessThan": "5.11", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "5.15.174", |
| "lessThanOrEqual": "5.15.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.1.120", |
| "lessThanOrEqual": "6.1.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.6.64", |
| "lessThanOrEqual": "6.6.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.11.11", |
| "lessThanOrEqual": "6.11.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.12.2", |
| "lessThanOrEqual": "6.12.*", |
| "status": "unaffected", |
| "versionType": "semver" |
| }, |
| { |
| "version": "6.13", |
| "lessThanOrEqual": "*", |
| "status": "unaffected", |
| "versionType": "original_commit_for_fix" |
| } |
| ] |
| } |
| ], |
| "cpeApplicability": [ |
| { |
| "nodes": [ |
| { |
| "operator": "OR", |
| "negate": false, |
| "cpeMatch": [ |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.11", |
| "versionEndExcluding": "5.15.174" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.11", |
| "versionEndExcluding": "6.1.120" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.11", |
| "versionEndExcluding": "6.6.64" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.11", |
| "versionEndExcluding": "6.11.11" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.11", |
| "versionEndExcluding": "6.12.2" |
| }, |
| { |
| "vulnerable": true, |
| "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", |
| "versionStartIncluding": "5.11", |
| "versionEndExcluding": "6.13" |
| } |
| ] |
| } |
| ] |
| } |
| ], |
| "references": [ |
| { |
| "url": "https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7" |
| }, |
| { |
| "url": "https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0" |
| } |
| ], |
| "title": "svcrdma: Address an integer overflow", |
| "x_generator": { |
| "engine": "bippy-1.2.0" |
| } |
| } |
| }, |
| "cveMetadata": { |
| "assignerOrgId": "f4215fc3-5b6b-47ff-a258-f7189bd81038", |
| "cveID": "CVE-2024-53151", |
| "requesterUserId": "gregkh@kernel.org", |
| "serial": "1", |
| "state": "PUBLISHED" |
| }, |
| "dataType": "CVE_RECORD", |
| "dataVersion": "5.0" |
| } |
