cve/published/2024/CVE-2024-53151.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-53151: svcrdma: Address an integer overflow

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

svcrdma: Address an integer overflow

Dan Carpenter reports:
> Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data
> structure") from Jun 22, 2020 (linux-next), leads to the following
> Smatch static checker warning:
>
>	net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()
>	warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
>
> net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
>     488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)
>     489 {
>     490         u32 segcount;
>     491         __be32 *p;
>     492
>     493         if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount))
>                                                               ^^^^^^^^
>
>     494                 return false;
>     495
>     496         /* A bogus segcount causes this buffer overflow check to fail. */
>     497         p = xdr_inline_decode(&rctxt->rc_stream,
> --> 498                               segcount * rpcrdma_segment_maxsz * sizeof(*p));
>
>
> segcount is an untrusted u32.  On 32bit systems anything >= SIZE_MAX / 16 will
> have an integer overflow and some those values will be accepted by
> xdr_inline_decode().

The Linux kernel CVE team has assigned CVE-2024-53151 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 and fixed in 5.15.174 with commit 21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b
	Issue introduced in 5.11 with commit 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 and fixed in 6.1.120 with commit c1f8195bf68edd2cef0f18a4cead394075a54b5a
	Issue introduced in 5.11 with commit 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 and fixed in 6.6.64 with commit 838dd342962cef4c320632a5af48d3c31f2f9877
	Issue introduced in 5.11 with commit 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 and fixed in 6.11.11 with commit 4cbc3ba6dc2f746497cade60bcbaa82ae3696689
	Issue introduced in 5.11 with commit 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 and fixed in 6.12.2 with commit e5c440c227ecdc721f2da0dd88b6358afd1031a7
	Issue introduced in 5.11 with commit 78147ca8b4a9b6cf0e597ddd6bf17959e08376c2 and fixed in 6.13 with commit 3c63d8946e578663b868cb9912dac616ea68bfd0

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-53151
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sunrpc/xprtrdma/svc_rdma_recvfrom.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b
	https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a
	https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877
	https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689
	https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7
	https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0