Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpc_preparse(), there are two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads <= 28 bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly validates the ticket length against AFSTOKEN_RK_TIX_MAX, the non-XDR path fails to do so. This allows an unprivileged user to provide a very large ticket length. When this key is later read via rxrpc_read(), the total token size (toksize) calculation results in a value that exceeds AFSTOKEN_LENGTH_MAX, triggering a WARN_ON(). [ 2001.302904] WARNING: CPU: 2 PID: 2108 at net/rxrpc/key.c:778 rxrpc_read+0x109/0x5c0 [rxrpc] Fix this by adding a check in the non-XDR parsing path of rxrpc_preparse() to ensure the ticket length does not exceed AFSTOKEN_RK_TIX_MAX, bringing it into parity with the XDR parsing logic.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < 44714dfda386884919ba366411880b6fb3c3efd3affected8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < 41a117dd80371343babc52198d1114e83eb37627affected8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < 9a397aa9b5e53ca63d4d6aefb542832eca389618affected8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < 1fa36cf495b0023e8475d038535c05e4063211e1affected8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < 4458757c020592a3094366e0fb20457383b42f92affected8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < ce383ba615339f8eaec646a166d2c2b015bb5ca0affected8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < a1be1c9ece26cea69654f28b255ff9a7906b897baffected8a7a3eb4ddbe7c7e639170a64adede7cbd5a9247 to < ac33733b10b484d666f97688561670afd5861383affected
Linux Linux
Default version status: affected
3.17affected0 to < 3.17unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.136 to ≤ 6.6.*unaffected6.12.84 to ≤ 6.12.*unaffected6.18.25 to ≤ 6.18.*unaffected7.0.2 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/44714dfda386884919ba366411880b6fb3c3efd3 ↗
- https://git.kernel.org/stable/c/41a117dd80371343babc52198d1114e83eb37627 ↗
- https://git.kernel.org/stable/c/9a397aa9b5e53ca63d4d6aefb542832eca389618 ↗
- https://git.kernel.org/stable/c/1fa36cf495b0023e8475d038535c05e4063211e1 ↗
- https://git.kernel.org/stable/c/4458757c020592a3094366e0fb20457383b42f92 ↗
- https://git.kernel.org/stable/c/ce383ba615339f8eaec646a166d2c2b015bb5ca0 ↗
- https://git.kernel.org/stable/c/a1be1c9ece26cea69654f28b255ff9a7906b897b ↗
- https://git.kernel.org/stable/c/ac33733b10b484d666f97688561670afd5861383 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗