s390/pkey: Prevent overflow in size calculation for memdup_user()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 5.15.187, 6.1.143, 6.6.96, 6.12.36, 6.15.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: s390/pkey: Prevent overflow in size calculation for memdup_user() Number of apqn target list entries contained in 'nr_apqns' variable is determined by userspace via an ioctl call so the result of the product in calculation of size passed to memdup_user() may overflow. In this case the actual size of the allocated area and the value describing it won't be in sync leading to various types of unpredictable behaviour later. Use a proper memdup_array_user() helper which returns an error if an overflow is detected. Note that it is different from when nr_apqns is initially zero - that case is considered valid and should be handled in subsequent pkey_handler implementations. Found by Linux Verification Center (linuxtesting.org).
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
From f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d · fixed in ad1bdd24a02d5a8d119af8e4cd50933780a6d29f; From f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d · fixed in faa1ab4a23c42e34dc000ef4977b751d94d5148c; From f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d · fixed in 88f3869649edbc4a13f6c2877091f81cd5a50f05; From f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d · fixed in f855b119e62b004a5044ed565f2a2b368c4d3f16; From f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d · fixed in 73483ca7e07a5e39bdf612eec9d3d293e8bef649; From f2bbc96e7cfad3891b7bf9bd3e566b9b7ab4553d · fixed in 7360ee47599af91a1d5f4e74d635d9408a54e489
- Linux Linux
5.4
- KernelLinux
From 5.4.0 · fixed in 5.15.187; From 5.16.0 · fixed in 6.1.143; From 6.2.0 · fixed in 6.6.96; From 6.7.0 · fixed in 6.12.36; From 6.13.0 · fixed in 6.15.5