In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like gating the position and count adjustment on whether or not the result is bigger-than-or-equal to zero (where bigger than makes more sense), and not checking the return value of blkdev_direct_IO() before doing an iov_iter_revert(). The latter can lead to attempting to revert with a negative value, which when passed to iov_iter_revert() as an unsigned value will lead to throwing a WARN_ON() because unroll is bigger than MAX_RW_COUNT. Be sane and don't revert for -EIOCBQUEUED, like what is done in other spots.
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: bloque: no revertir iter para -EIOCBQUEUED blkdev_read_iter() tiene algunas comprobaciones extrañas, como bloquear el ajuste de posición y conteo en función de si el resultado es o no mayor o igual a cero (donde mayor que tiene más sentido), y no verificar el valor de retorno de blkdev_direct_IO() antes de hacer un iov_iter_revert(). Esto último puede llevar a intentar revertir con un valor negativo, que cuando se pasa a iov_iter_revert() como un valor sin signo conducirá a lanzar un WARN_ON() porque unroll es mayor que MAX_RW_COUNT. Sea sensato y no revierta para -EIOCBQUEUED, como lo que se hace en otros lugares.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
NVD-CWE-noinfo
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbe95e80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b13afc0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3842ba700> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd2dbe94500> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd2dbe94340> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd2dbe976c0> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd2dbe94440> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd2dbe952c0> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd2dbe95980> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd2dbe94880> | Operating System |
| linux | linux_kernel | 5.17 | <built-in method update of dict object at 0x7fd2dbe97940> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc7:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.17:rc8:*:*:*:*:*:* |