Description
In the Linux kernel, the following vulnerability has been resolved: dm mirror log: round up region bitmap size to BITS_PER_LONG The code in dm-log rounds up bitset_size to 32 bits. It then uses find_next_zero_bit_le on the allocated region. find_next_zero_bit_le accesses the bitmap using unsigned long pointers. So, on 64-bit architectures, it may access 4 bytes beyond the allocated size. Fix this bug by rounding up bitset_size to BITS_PER_LONG. This bug was found by running the lvm2 testsuite with kasan.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
29121bd0b00ebb9524971a583fea4a2f7afe8041 to < ae460312875159285cef5bf3dc654593f404a1efaffected29121bd0b00ebb9524971a583fea4a2f7afe8041 to < ba751f0d25f07aa21ce9b85372a3792bf7969d13affected29121bd0b00ebb9524971a583fea4a2f7afe8041 to < 0d2209b54f1de0c2f99cab246d4cf2cfe24aaaa9affected29121bd0b00ebb9524971a583fea4a2f7afe8041 to < 9a02f3275acc628c0d956be771405ced79ac36dfaffected29121bd0b00ebb9524971a583fea4a2f7afe8041 to < 85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0affected
Linux Linux
Default version status: affected
2.6.18affected0 to < 2.6.18unaffected5.4.200 to ≤ 5.4.*unaffected5.10.124 to ≤ 5.10.*unaffected5.15.49 to ≤ 5.15.*unaffected5.18.6 to ≤ 5.18.*unaffected5.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ae460312875159285cef5bf3dc654593f404a1ef ↗
- https://git.kernel.org/stable/c/ba751f0d25f07aa21ce9b85372a3792bf7969d13 ↗
- https://git.kernel.org/stable/c/0d2209b54f1de0c2f99cab246d4cf2cfe24aaaa9 ↗
- https://git.kernel.org/stable/c/9a02f3275acc628c0d956be771405ced79ac36df ↗
- https://git.kernel.org/stable/c/85e123c27d5cbc22cfdc01de1e2ca1d9003a02d0 ↗