Description
In the Linux kernel, the following vulnerability has been resolved: mips: sched: Fix CPUMASK_OFFSTACK memory corruption This patch addresses a critical memory management flaw. When CONFIG_CPUMASK_OFFSTACK is enabled, cpumask_var_t is a pointer. Consequently, sizeof(new_mask) evaluates to the pointer size, causing copy_from_user() to clobber the mask pointer. Furthermore, the old logic performed copy_from_user() before allocating the mask. Fix this by allocating new_mask first. To handle variable-sized user masks correctly, use cpumask_size() to truncate overly large user masks or pad undersized masks with zeros before copying the data directly into the allocated buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < 2f7730c03a9deea3ba7a1c980070d363b4ea2046affected295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < d20ee42f8226607b5693b2bc2f115ca2d270221aaffected295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < 15ba8053fe4162c933855f1676fb321cdb6251c7affected295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < 3446ffb5d03c36f9ce88ede7ca5be319a2968d96affected295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < 87a56c1e8e36d06ebe8640432f911538ded7827daffected295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < 1caee6e084a96ada94658f261ced377d85af3f03affected295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < a1dd41d00c57efb1fbc6f361c5f48c9d00cca51caffected295cbf6d63165fe4253cf1d9ceadcda47a318b48 to < 98e37db4a34d3af3fb2f4648295c25b5e40b20e3affected
Linux Linux
Default version status: affected
2.6.23affected0 to < 2.6.23unaffected5.10.265 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2f7730c03a9deea3ba7a1c980070d363b4ea2046 ↗
- https://git.kernel.org/stable/c/d20ee42f8226607b5693b2bc2f115ca2d270221a ↗
- https://git.kernel.org/stable/c/15ba8053fe4162c933855f1676fb321cdb6251c7 ↗
- https://git.kernel.org/stable/c/3446ffb5d03c36f9ce88ede7ca5be319a2968d96 ↗
- https://git.kernel.org/stable/c/87a56c1e8e36d06ebe8640432f911538ded7827d ↗
- https://git.kernel.org/stable/c/1caee6e084a96ada94658f261ced377d85af3f03 ↗
- https://git.kernel.org/stable/c/a1dd41d00c57efb1fbc6f361c5f48c9d00cca51c ↗
- https://git.kernel.org/stable/c/98e37db4a34d3af3fb2f4648295c25b5e40b20e3 ↗