Description
In the Linux kernel, the following vulnerability has been resolved: dm array: reject an array block whose value size is not the caller's array_block_check() can only compare the header against itself, so a block with value_size 4 and max_entries 1018 is internally consistent and passes. dm-cache keeps two arrays -- mappings at 8 bytes and hints at 4 -- and the roots for both live in the superblock. Point the mappings root at a hint block and __load_mappings() walks it through an info whose value size is 8, so element_at() strides 8 bytes over 4-byte entries and reaches offset 8160 of a 4096-byte block. get_ablock() and __shadow_ablock() are the two places that hold the block and the caller at once. Reject there when the two value sizes disagree. Arrays only ever read their own blocks, so this fires on crafted metadata only.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < 35cd3b278448c79614f65ab6bbc9ed348d847df9affected6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < a8237cb8fa0a628d903e76635bfdeae4202036b9affected6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < a530a9a419a7c5fdb7dae55ffa2dd7a130631842affected6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < 522fa26da24ccaa298ebe3c1c97395d2d63dfc21affected6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < 7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168caffected6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < ac4a5eb8b002a0742c938fc98b922e243f53573aaffected6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < cb409b38b0232ee4385ef55cddcd6fbdd011a8a2affected6513c29f44f2cc970c0e9fecfe5a6526c3e73025 to < 4538a287bdf5d0f9a379c678e5262b9f5783f547affected
Linux Linux
Default version status: affected
3.9affected0 to < 3.9unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.109 to ≤ 6.12.*unaffected6.18.50 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/35cd3b278448c79614f65ab6bbc9ed348d847df9 ↗
- https://git.kernel.org/stable/c/a8237cb8fa0a628d903e76635bfdeae4202036b9 ↗
- https://git.kernel.org/stable/c/a530a9a419a7c5fdb7dae55ffa2dd7a130631842 ↗
- https://git.kernel.org/stable/c/522fa26da24ccaa298ebe3c1c97395d2d63dfc21 ↗
- https://git.kernel.org/stable/c/7bf4b5cb42a4e27f36bcbc6209d82a5da9c0168c ↗
- https://git.kernel.org/stable/c/ac4a5eb8b002a0742c938fc98b922e243f53573a ↗
- https://git.kernel.org/stable/c/cb409b38b0232ee4385ef55cddcd6fbdd011a8a2 ↗
- https://git.kernel.org/stable/c/4538a287bdf5d0f9a379c678e5262b9f5783f547 ↗