Description
In the Linux kernel, the following vulnerability has been resolved: s390/monwriter: Reject buffer reuse with different data length When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwriter code does not check if the data length was changed for subsequent records, which also would never happen for valid user programs. However, a malicious user could change the data length, resulting in out of bounds user copy to the kernel buffer, and memory corruption. By default, the monwriter misc device is created with root-only permissions, so practical impact is typically low. Fix this by checking for changed data length and rejecting such records.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
31b58088292c7f00f0b81088bfb557285b0b6247 to < 096dff1247037d329c04b3a5be0ecdfb1c5c7ac6affected31b58088292c7f00f0b81088bfb557285b0b6247 to < d39cf4a6d721b1ae21eb53bbf3e8cd984253d7abaffected31b58088292c7f00f0b81088bfb557285b0b6247 to < 759d91378203ea35fa9bca6726dcf0010de081fbaffected31b58088292c7f00f0b81088bfb557285b0b6247 to < 036bc5661060702e798d215e81bb46da530965b3affected31b58088292c7f00f0b81088bfb557285b0b6247 to < 01f3ce411711c2c919598ea25320a5a48f71edbcaffected31b58088292c7f00f0b81088bfb557285b0b6247 to < f0745496f7c171271cafd9457df3b914a483ddebaffected31b58088292c7f00f0b81088bfb557285b0b6247 to < ae5347f3db1782c6118f6cc0d9fd8b1d43397db3affected31b58088292c7f00f0b81088bfb557285b0b6247 to < 2995ccec260caa9e85b3301a4aba1e66ed80ad74affected
Linux Linux
Default version status: affected
2.6.19affected0 to < 2.6.19unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/096dff1247037d329c04b3a5be0ecdfb1c5c7ac6 ↗
- https://git.kernel.org/stable/c/d39cf4a6d721b1ae21eb53bbf3e8cd984253d7ab ↗
- https://git.kernel.org/stable/c/759d91378203ea35fa9bca6726dcf0010de081fb ↗
- https://git.kernel.org/stable/c/036bc5661060702e798d215e81bb46da530965b3 ↗
- https://git.kernel.org/stable/c/01f3ce411711c2c919598ea25320a5a48f71edbc ↗
- https://git.kernel.org/stable/c/f0745496f7c171271cafd9457df3b914a483ddeb ↗
- https://git.kernel.org/stable/c/ae5347f3db1782c6118f6cc0d9fd8b1d43397db3 ↗
- https://git.kernel.org/stable/c/2995ccec260caa9e85b3301a4aba1e66ed80ad74 ↗