Description
In the Linux kernel, the following vulnerability has been resolved: dm integrity: fix memory corruption when tag_size is less than digest size It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
a3fcf7253139609bf9ff901fbf955fba047e75dd to < 6a95d91c0b315c965198f6ab7dec7c94129e17e0affecteda3fcf7253139609bf9ff901fbf955fba047e75dd to < 7f84c937222944c03f4615ca4742df6bed0e5adfaffecteda3fcf7253139609bf9ff901fbf955fba047e75dd to < cd02b2687d66f0a8e716384de4b9a0671331f1dcaffecteda3fcf7253139609bf9ff901fbf955fba047e75dd to < 6b4bf97587ef6c1927a78934b700204920655123affecteda3fcf7253139609bf9ff901fbf955fba047e75dd to < 4d485cf9b609709e45d5113e6e2b1b01254b2fe9affecteda3fcf7253139609bf9ff901fbf955fba047e75dd to < 08c1af8f1c13bbf210f1760132f4df24d0ed46d6affected
Linux Linux
Default version status: affected
4.19affected0 to < 4.19unaffected4.19.240 to ≤ 4.19.*unaffected5.4.190 to ≤ 5.4.*unaffected5.10.112 to ≤ 5.10.*unaffected5.15.35 to ≤ 5.15.*unaffected5.17.4 to ≤ 5.17.*unaffected5.18 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6a95d91c0b315c965198f6ab7dec7c94129e17e0 ↗
- https://git.kernel.org/stable/c/7f84c937222944c03f4615ca4742df6bed0e5adf ↗
- https://git.kernel.org/stable/c/cd02b2687d66f0a8e716384de4b9a0671331f1dc ↗
- https://git.kernel.org/stable/c/6b4bf97587ef6c1927a78934b700204920655123 ↗
- https://git.kernel.org/stable/c/4d485cf9b609709e45d5113e6e2b1b01254b2fe9 ↗
- https://git.kernel.org/stable/c/08c1af8f1c13bbf210f1760132f4df24d0ed46d6 ↗