Description
In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Bound image count in qla2x00_update_fru_versions() qla2x00_update_fru_versions() copies the user-supplied BSG request into a fixed 256-byte stack buffer (bsg[DMA_POOL_SIZE]) and then iterates list->count times over the qla_image_version array embedded in that buffer, advancing the image pointer each iteration. count is taken directly from user input with no upper bound, while only (DMA_POOL_SIZE - sizeof(list->count)) / sizeof(struct qla_image_version) = 6 entries actually fit. A larger count walks the image pointer off the end of the stack buffer, reading adjacent kernel stack memory and sending it to the device via qla2x00_write_sfp(). Reject requests whose declared count does not fit in the buffer.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < af733bbfcf667af1871a2735fba2835b0da71efbaffected697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < a9706d5e754e77515a92bb532bd0d73644979a1faffected697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < 7e3154c97ec15460f715dbbe4097c255cce110b1affected697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < 047f1f7ee6f85bde28abfdda9fa550191ddc0532affected697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < f93e8039e6fd54a3c027c6184daf00b745b576a0affected697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < 7b22b4cb8822805cef7ba618da6f76e1474d68bdaffected697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514affected697a4bc69159c3396035b0506ffa55c4b2d0b1f4 to < de62cf265dbe309f34f144a6cdbca9240317727eaffected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.51 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/af733bbfcf667af1871a2735fba2835b0da71efb ↗
- https://git.kernel.org/stable/c/a9706d5e754e77515a92bb532bd0d73644979a1f ↗
- https://git.kernel.org/stable/c/7e3154c97ec15460f715dbbe4097c255cce110b1 ↗
- https://git.kernel.org/stable/c/047f1f7ee6f85bde28abfdda9fa550191ddc0532 ↗
- https://git.kernel.org/stable/c/f93e8039e6fd54a3c027c6184daf00b745b576a0 ↗
- https://git.kernel.org/stable/c/7b22b4cb8822805cef7ba618da6f76e1474d68bd ↗
- https://git.kernel.org/stable/c/f2d4f025b67fcbfb2bbbadd3b5a6a43c4b436514 ↗
- https://git.kernel.org/stable/c/de62cf265dbe309f34f144a6cdbca9240317727e ↗