Description
In the Linux kernel, the following vulnerability has been resolved: libceph: guard missing CRUSH type name lookup Localized read selection can walk a parent bucket whose name exists in the CRUSH map while its type has no matching entry in type_names. get_immediate_parent() then dereferences a NULL type_cn and passes an invalid pointer into strcmp(), causing a null-ptr-deref. Skip such malformed parent buckets unless both the bucket name and type name metadata are present. This keeps malformed hierarchy data from crashing locality lookup and safely falls back to "not local". [ idryomov: add WARN_ON_ONCE ]
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
117d96a04f007ce8fc2e292369056c3bd09f6f63 to < cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0affected117d96a04f007ce8fc2e292369056c3bd09f6f63 to < 8ff579ac03d6e9d17d6d9c8443110167c14a382daffected117d96a04f007ce8fc2e292369056c3bd09f6f63 to < 6a4b75d90f0cfbf22c14742ab35a803bc13f36ecaffected117d96a04f007ce8fc2e292369056c3bd09f6f63 to < c46d82c47afc968d6ee8ef4470fa2dd35b765c21affected117d96a04f007ce8fc2e292369056c3bd09f6f63 to < 3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50affected117d96a04f007ce8fc2e292369056c3bd09f6f63 to < 4716a64b7cc2797741f7be4e283ace78a9dff37daffected117d96a04f007ce8fc2e292369056c3bd09f6f63 to < db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64daffected117d96a04f007ce8fc2e292369056c3bd09f6f63 to < bbeae12fda3384a90fbebc8a19ba9d33f85b5361affected
Linux Linux
Default version status: affected
5.8affected0 to < 5.8unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.148 to ≤ 6.6.*unaffected6.12.101 to ≤ 6.12.*unaffected6.18.42 to ≤ 6.18.*unaffected7.1.6 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/cbfcba275326c8c7dae9acd8f4a0d4c316fdafb0 ↗
- https://git.kernel.org/stable/c/8ff579ac03d6e9d17d6d9c8443110167c14a382d ↗
- https://git.kernel.org/stable/c/6a4b75d90f0cfbf22c14742ab35a803bc13f36ec ↗
- https://git.kernel.org/stable/c/c46d82c47afc968d6ee8ef4470fa2dd35b765c21 ↗
- https://git.kernel.org/stable/c/3767c9f0c1bbd98dd25cb088356a0fc6c1f09f50 ↗
- https://git.kernel.org/stable/c/4716a64b7cc2797741f7be4e283ace78a9dff37d ↗
- https://git.kernel.org/stable/c/db9cc9fd9660b2d69ee66f5a4cbec83c21a1c64d ↗
- https://git.kernel.org/stable/c/bbeae12fda3384a90fbebc8a19ba9d33f85b5361 ↗