RDMA/uverbs: Guard legacy bundles without method_elm
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.2.4
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Guard legacy bundles without method_elm The legacy write() path dispatches through a uverbs_api_write_method, but the uverbs_attr_bundle passed to provider code does not have an ioctl method element. If malformed provider input causes the common uverbs validation code to emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer. Initialize method_elm explicitly for legacy bundles and make uverbs_get_handler_fn() return NULL when no ioctl method is present. The legacy dispatcher continues to use its local write method, while the ioctl path continues to use the registered ioctl handler.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 7122ff96068a03595bde2fbafaca82ca2ed8084e · fixed in edae84e5461749ed9adf9fcf5c6e075381040ac3; From 7122ff96068a03595bde2fbafaca82ca2ed8084e · fixed in 60a42d510113f46de47e86a84bf5758597644487
- Linux Linux
7.1
- KernelLinux
From 7.1.0 · fixed in 7.2.4