Description
In the Linux kernel, the following vulnerability has been resolved: zram: fix out-of-bounds access in read_block_state() read_block_state() calculates nr_pages before taking dev_lock. If the device is reset and reinitialized with a smaller disksize before lock acquisition, nr_pages still describes the old table. The subsequent loop can then call slot_lock() past the end of the newly allocated table. Read disksize after acquiring dev_lock and checking that the device is initialized. The read lock then keeps the table and its bound stable for the duration of the scan.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < fee53224c8261541cf310b57ac7c77a80e144483affectedc0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < 26a55336be91004dbd438f3b89b0c31617459976affectedc0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < a189cae92e97d90a9553740f5558d6f74446d3d1affectedc0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < f5e9f3a75efc774f17ab3f33826630d7fe30c7eaaffectedc0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < 6d52c1f43ff39ea1ebf8f016e847677f0b60cf2baffectedc0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739daffectedc0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < 5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3affectedc0265342bff4fcaa2cdf13f4596244c18d4a7ae5 to < 391f057f44a51cc9418da5cba78b014324174264affected
Linux Linux
Default version status: affected
4.18affected0 to < 4.18unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.4 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/fee53224c8261541cf310b57ac7c77a80e144483 ↗
- https://git.kernel.org/stable/c/26a55336be91004dbd438f3b89b0c31617459976 ↗
- https://git.kernel.org/stable/c/a189cae92e97d90a9553740f5558d6f74446d3d1 ↗
- https://git.kernel.org/stable/c/f5e9f3a75efc774f17ab3f33826630d7fe30c7ea ↗
- https://git.kernel.org/stable/c/6d52c1f43ff39ea1ebf8f016e847677f0b60cf2b ↗
- https://git.kernel.org/stable/c/e7dbcb7a561a21e9a8f5b5fa90bb95aefbd0739d ↗
- https://git.kernel.org/stable/c/5e458fa714a55b6b64a9fe0c6d4fa609609f9ec3 ↗
- https://git.kernel.org/stable/c/391f057f44a51cc9418da5cba78b014324174264 ↗