In the Linux kernel, the following vulnerability has been resolved: mm: avoid overflows in dirty throttling logic The dirty throttling logic is interspersed with assumptions that dirty limits in PAGE_SIZE units fit into 32-bit (so that various multiplications fit into 64-bits). If limits end up being larger, we will hit overflows, possible divisions by 0 etc. Fix these problems by never allowing so large dirty limits as they have dubious practical value anyway. For dirty_bytes / dirty_background_bytes interfaces we can just refuse to set so large limits. For dirty_ratio / dirty_background_ratio it isn't so simple as the dirty limit is computed from the amount of available memory which can change due to memory hotplug etc. So when converting dirty limits from ratios to numbers of pages, we just don't allow the result to exceed UINT_MAX. This is root-only triggerable problem which occurs when the operator sets dirty limits to >16 TB.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: mm: evitar desbordamientos en la lógica de limitación sucia La lógica de limitación sucia se entremezcla con suposiciones de que los límites sucios en unidades PAGE_SIZE caben en 32 bits (de modo que varias multiplicaciones caben en 64 bits) . Si los límites terminan siendo mayores, tendremos desbordamientos, posibles divisiones entre 0, etc. Solucione estos problemas nunca permitiendo límites sucios tan grandes, ya que de todos modos tienen un valor práctico dudoso. Para las interfaces dirty_bytes/dirty_background_bytes podemos simplemente negarnos a establecer límites tan grandes. Para dirty_ratio / dirty_background_ratio no es tan simple ya que el límite sucio se calcula a partir de la cantidad de memoria disponible que puede cambiar debido a la conexión en caliente de la memoria, etc. Entonces, al convertir límites sucios de proporciones a números de páginas, simplemente no permitimos el el resultado excede UINT_MAX. Este es un problema que se puede activar solo desde la raíz y que ocurre cuando el operador establece límites sucios en >16 TB.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | HIGH |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-190
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd384625c80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbf95580> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341e39200> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c4a7b40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd342e4dd80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd342e4f8c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd39c46c840> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd2d2496a40> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd3703f46c0> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd342e4f1c0> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd3694e1040> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd39c4a5940> | Operating System |
| linux | linux_kernel | 6.10 | <built-in method update of dict object at 0x7fd341e39100> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:6.10:rc6:*:*:*:*:*:* |