Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix TOCTOU heap overflow in get_srq_wqe get_srq_wqe() reads wqe->dma.num_sge from the shared receive queue buffer, which is mapped into userspace. It validates num_sge against max_sge, but then re-reads the same field to calculate the memcpy size. A concurrent userspace thread can modify num_sge between validation and use, causing a heap buffer overflow when copying the WQE into qp->resp.srq_wqe. Read num_sge into a local variable and use it for both the bounds check and the size calculation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8700e3e7c4857d28ebaa824509934556da0b3e76 to < c8db0e5ab0b6c540214c46c56aaac7cbcb0967feaffected8700e3e7c4857d28ebaa824509934556da0b3e76 to < e48daa94ad2d406225b73491fc935064716f0ec7affected8700e3e7c4857d28ebaa824509934556da0b3e76 to < 3cfa2a3adc51b7c57729961a03446962ff10e3d2affected8700e3e7c4857d28ebaa824509934556da0b3e76 to < cd19a6345e3727adafafa5954b58b13c92e13b80affected8700e3e7c4857d28ebaa824509934556da0b3e76 to < 3e07ea9579dc9553d2285c26c2823931358aa3b8affected8700e3e7c4857d28ebaa824509934556da0b3e76 to < 02558c86b6b761063e9399e6b939984500327ef1affected8700e3e7c4857d28ebaa824509934556da0b3e76 to < b9800d7953d119bcc068c74587d48e4ba0313629affected8700e3e7c4857d28ebaa824509934556da0b3e76 to < 22b8fbded65b8c441b634a185f8da67657df6c50affected
Linux Linux
Default version status: affected
4.8affected0 to < 4.8unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c8db0e5ab0b6c540214c46c56aaac7cbcb0967fe ↗
- https://git.kernel.org/stable/c/e48daa94ad2d406225b73491fc935064716f0ec7 ↗
- https://git.kernel.org/stable/c/3cfa2a3adc51b7c57729961a03446962ff10e3d2 ↗
- https://git.kernel.org/stable/c/cd19a6345e3727adafafa5954b58b13c92e13b80 ↗
- https://git.kernel.org/stable/c/3e07ea9579dc9553d2285c26c2823931358aa3b8 ↗
- https://git.kernel.org/stable/c/02558c86b6b761063e9399e6b939984500327ef1 ↗
- https://git.kernel.org/stable/c/b9800d7953d119bcc068c74587d48e4ba0313629 ↗
- https://git.kernel.org/stable/c/22b8fbded65b8c441b634a185f8da67657df6c50 ↗