In the Linux kernel, the following vulnerability has been resolved: iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() Resolve a UBSAN shift-out-of-bounds issue in iova_bitmap_offset_to_index() where shifting the constant "1" (of type int) by bitmap->mapped.pgshift (an unsigned long value) could result in undefined behavior. The constant "1" defaults to a 32-bit "int", and when "pgshift" exceeds 31 (e.g., pgshift = 63) the shift operation overflows, as the result cannot be represented in a 32-bit type. To resolve this, the constant is updated to "1UL", promoting it to an unsigned long type to match the operand's type.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: iommufd/iova_bitmap: Se soluciona el problema de desplazamiento fuera de los límites en iova_bitmap_offset_to_index() Se soluciona un problema de desplazamiento fuera de los límites de UBSAN en iova_bitmap_offset_to_index() donde desplazar la constante "1" (de tipo int) por bitmap->mapped.pgshift (un valor unsigned long) podría resultar en un comportamiento indefinido. La constante "1" tiene como valor predeterminado un "int" de 32 bits, y cuando "pgshift" supera los 31 (por ejemplo, pgshift = 63) la operación de desplazamiento se desborda, ya que el resultado no se puede representar en un tipo de 32 bits. Para resolver esto, la constante se actualiza a "1UL", promoviéndola a un tipo unsigned long para que coincida con el tipo del operando.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bdcf6a3c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bcc386f00> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bcc386780> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x702bcc384dc0> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |