In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the function retrieve_status: 1. The code in retrieve_status checks that the output string fits into the output buffer and writes the output string there 2. Then, the code aligns the "outptr" variable to the next 8-byte boundary: outptr = align_ptr(outptr); 3. The alignment doesn't check overflow, so outptr could point past the buffer end 4. The "for" loop is iterated again, it executes: remaining = len - (outptr - outbuf); 5. If "outptr" points past "outbuf + len", the arithmetics wraps around and the variable "remaining" contains unusually high number 6. With "remaining" being high, the code writes more data past the end of the buffer Luckily, this bug has no security implications because: 1. Only root can issue device mapper ioctls 2. The commonly used libraries that communicate with device mapper (libdevmapper and devicemapper-rs) use buffer size that is aligned to 8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input buffer and the bug can't happen accidentally
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: dm: corrige un desbordamiento de búfer en el procesamiento de ioctl Tony Asleson (usando Claude) encontró un desbordamiento de búfer en dm-ioctl en la función retrieve_status: 1. El código en retrieve_status verifica que la cadena de salida cabe en el búfer de salida y escribe la cadena de salida allí 2. Luego, el código alinea la variable 'outptr' al siguiente límite de 8 bytes: outptr = align_ptr(outptr); 3. La alineación no verifica el desbordamiento, por lo que 'outptr' podría apuntar más allá del final del búfer 4. El bucle 'for' se itera de nuevo, ejecuta: remaining = len - (outptr - outbuf); 5. Si 'outptr' apunta más allá de 'outbuf + len', la aritmética se desborda y la variable 'remaining' contiene un número inusualmente alto 6. Siendo 'remaining' alto, el código escribe más datos más allá del final del búfer Afortunadamente, este error no tiene implicaciones de seguridad porque: 1. Solo root puede emitir ioctls del mapeador de dispositivos 2. Las bibliotecas comúnmente utilizadas que se comunican con el mapeador de dispositivos (libdevmapper y devicemapper-rs) usan un tamaño de búfer que está alineado a 8 bytes; por lo tanto, 'outptr = align_ptr(outptr)' no puede exceder el búfer de entrada y el error no puede ocurrir accidentalmente
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-787
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3694cad40> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd31b2a0700> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36b8a4780> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a6d12c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd31b2a07c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd3606e23c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd369c0f1c0> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd369c0f880> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd37034a340> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd3606e1600> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd370225bc0> | Operating System |
| linux | linux_kernel | 2.6.12 | <built-in method update of dict object at 0x7fd370348200> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:* |