Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla4xxx: Add length check when parsing nlattrs There are three places that qla4xxx parses nlattrs: - qla4xxx_set_chap_entry() - qla4xxx_iface_set_param() - qla4xxx_sysfs_ddb_set_param() and each of them directly converts the nlattr to specific pointer of structure without length checking. This could be dangerous as those attributes are not validated and a malformed nlattr (e.g., length 0) could result in an OOB read that leaks heap dirty data. Add the nla_len check before accessing the nlattr data and return EINVAL if the length check fails.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < cfa6a1a79ed6d336fac7a5d87eb5471e4401829faffected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < 5925e224cc6edfef57b20447f18323208461309baffected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < 47f3be62eab50b8cd7e1ae5fc2c4dae687497c34affected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < 6d65079c69dc1feb817ed71f5bd15e83a7d6832daffected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < f61fc650c47849637fa1771a31a11674c824138aaffected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < 25feffb3fbd51ae81d92c65cebc0e932663828b3affected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < 4ed21975311247bb84e82298eeb359ec0a0fa84daffected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < b018c0440b871d8b001c996e95fa4538bd292de6affected00c31889f7513e9ffa6b2b4de8ad6d7f59a61c80 to < 47cd3770e31df942e2bb925a9a855c79ed0662ebaffected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected4.14.326 to ≤ 4.14.*unaffected4.19.295 to ≤ 4.19.*unaffected5.4.257 to ≤ 5.4.*unaffected5.10.195 to ≤ 5.10.*unaffected5.15.132 to ≤ 5.15.*unaffected6.1.53 to ≤ 6.1.*unaffected6.4.16 to ≤ 6.4.*unaffected6.5.3 to ≤ 6.5.*unaffected6.6 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/cfa6a1a79ed6d336fac7a5d87eb5471e4401829f ↗
- https://git.kernel.org/stable/c/5925e224cc6edfef57b20447f18323208461309b ↗
- https://git.kernel.org/stable/c/47f3be62eab50b8cd7e1ae5fc2c4dae687497c34 ↗
- https://git.kernel.org/stable/c/6d65079c69dc1feb817ed71f5bd15e83a7d6832d ↗
- https://git.kernel.org/stable/c/f61fc650c47849637fa1771a31a11674c824138a ↗
- https://git.kernel.org/stable/c/25feffb3fbd51ae81d92c65cebc0e932663828b3 ↗
- https://git.kernel.org/stable/c/4ed21975311247bb84e82298eeb359ec0a0fa84d ↗
- https://git.kernel.org/stable/c/b018c0440b871d8b001c996e95fa4538bd292de6 ↗
- https://git.kernel.org/stable/c/47cd3770e31df942e2bb925a9a855c79ed0662eb ↗