Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: libceph: Avoid using invalid osd indices from primary_temp A corrupted osdmap received from a Ceph monitor or OSD may contain osd indices in its pg_temp, primary_temp, pg_upmap, and pg_upmap_items parts that don't exist, i.e., that are greater than max_osd or smaller than CEPH_HOMELESS_OSD (-1). These indices are used to create the up and acting set in ceph_pg_to_up_acting_osds(), called from calc_target(). While most of these osd indices are checked, the one from primary_temp is not. Subsequently, this may lead to calc_target() returning this (potentially invalid) index as target osd for a (linger) request. Because the osd_state, osd_weight, and osd_addr arrays only contain max_osd entries (with indices 0 to max_osd -1), this leads to out-of-bounds accesses when trying to read values from these arrays. This patch fixes the issue by adding a check to get_temp_osds(), so that only valid osd indices from primary_temp are used, and it falls back to using the primary from pg_temp or the up set if it is invalid. [ idryomov: changelog ]
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 5e8d4d36bf23bb7baf027c479d54395840219928 before 505fc50b8ff8e687b7e3ef6866269dea27366224; affected 5e8d4d36bf23bb7baf027c479d54395840219928 before 1c705fe8e59c6b16f48964973fb23c8ec4735b73; affected 5e8d4d36bf23bb7baf027c479d54395840219928 before dfe1877d351b99eb1b1a62a3fc2d174220e88e20; affected 5e8d4d36bf23bb7baf027c479d54395840219928 before e2ffeec85201b2bb748e99e12539ee1b92f62796; affected 5e8d4d36bf23bb7baf027c479d54395840219928 before 6799d4a916ffcb3d450d8440f9fe0f0862f768d6; affected 5e8d4d36bf23bb7baf027c479d54395840219928 before 4f392fec075562dc93bb0c69f37423ca2af9b48f; affected 5e8d4d36bf23bb7baf027c479d54395840219928 before e009c5f0ad634c62f5c48a41f1f3c019ecf52555; affected 5e8d4d36bf23bb7baf027c479d54395840219928 before 3660b98d1204b419f6a77e9a295f148dcf38d042 |
| Linux / Linux | affected 3.15; unaffected 0 before 3.15; unaffected 5.10.266 through 5.10.*; unaffected 5.15.217 through 5.15.*; unaffected 6.1.184 through 6.1.*; unaffected 6.6.153 through 6.6.*; unaffected 6.12.105 through 6.12.*; unaffected 6.18.46 through 6.18.*; unaffected 7.1.10 through 7.1.*; unaffected 7.2 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/505fc50b8ff8e687b7e3ef6866269dea27366224
- https://git.kernel.org/stable/c/1c705fe8e59c6b16f48964973fb23c8ec4735b73
- https://git.kernel.org/stable/c/dfe1877d351b99eb1b1a62a3fc2d174220e88e20
- https://git.kernel.org/stable/c/e2ffeec85201b2bb748e99e12539ee1b92f62796
- https://git.kernel.org/stable/c/6799d4a916ffcb3d450d8440f9fe0f0862f768d6
- https://git.kernel.org/stable/c/4f392fec075562dc93bb0c69f37423ca2af9b48f
- https://git.kernel.org/stable/c/e009c5f0ad634c62f5c48a41f1f3c019ecf52555
- https://git.kernel.org/stable/c/3660b98d1204b419f6a77e9a295f148dcf38d042
ADP enrichment
No English description supplied.
No references supplied.