Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix out-of-bounds write in irdma_copy_user_pgaddrs The irdma_copy_user_pgaddrs function loops through all of the umem DMA blocks to populate the PBLEs and will stop when either the last DMA block is reached or palloc->total_cnt is reached. The issue is that the logic for checking palloc->total_cnt would only work for non-zero values. When irdma_setup_pbles is called with lvl==0, it calls irdma_copy_user_pgaddrs with palloc->total_cnt==0, which means the only way to break out of the loop is to reach the last umem DMA block, which means it could end up going beyond the fixed size of 4 iwmr->pgaddrmem array that is used in the lvl==0 case. In the case of QP/CQ/SRQ rings, the value of lvl is determined by a separate input (for example, req.cq_pages in the case of a CQ). So, we must perform explicit checking to ensure we don't overflow the pgaddrmem array if the user provides a umem that consists of more blocks than their provided req.cq_pages.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected b48c24c2d710cf34810c555dcef883a3d35a9c08 before 4780f58672ee6328accd54a95f9c00683477e499; affected b48c24c2d710cf34810c555dcef883a3d35a9c08 before 79a20a8e201a779224b4bf115250a7713bde72c0; affected b48c24c2d710cf34810c555dcef883a3d35a9c08 before 9f8f0d2099e3de1194e37dc933ae0c4206b09aaf; affected b48c24c2d710cf34810c555dcef883a3d35a9c08 before 192a3be0e3759daa24af2841208b074ca6dbaabc; affected b48c24c2d710cf34810c555dcef883a3d35a9c08 before 424d51d33c7541a86934067c2c0538124687fc90; affected b48c24c2d710cf34810c555dcef883a3d35a9c08 before abd27a977b419d584efa659488c22d2306987b29; affected b48c24c2d710cf34810c555dcef883a3d35a9c08 before 5ebb3ed757be3e04cf803026004aa0beaeb13e9b |
| Linux / Linux | affected 5.14; unaffected 0 before 5.14; unaffected 5.15.212 through 5.15.*; unaffected 6.1.178 through 6.1.*; unaffected 6.6.145 through 6.6.*; unaffected 6.12.97 through 6.12.*; unaffected 6.18.40 through 6.18.*; unaffected 7.1.5 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/4780f58672ee6328accd54a95f9c00683477e499
- https://git.kernel.org/stable/c/79a20a8e201a779224b4bf115250a7713bde72c0
- https://git.kernel.org/stable/c/9f8f0d2099e3de1194e37dc933ae0c4206b09aaf
- https://git.kernel.org/stable/c/192a3be0e3759daa24af2841208b074ca6dbaabc
- https://git.kernel.org/stable/c/424d51d33c7541a86934067c2c0538124687fc90
- https://git.kernel.org/stable/c/abd27a977b419d584efa659488c22d2306987b29
- https://git.kernel.org/stable/c/5ebb3ed757be3e04cf803026004aa0beaeb13e9b
ADP enrichment
No English description supplied.
No references supplied.