Description
In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix buffer overflow in inline mode with large tag size In inline mode, dm_integrity_check and dm_integrity_inline_recheck compute the checksum of each block into an on-stack buffer of HASH_MAX_DIGESTSIZE bytes. integrity_sector_checksum pads its result with zeroes up to the tag size, so if the tag size is larger than HASH_MAX_DIGESTSIZE, the padding runs past the end of the buffer. With CONFIG_STACKPROTECTOR the kernel panics in dm_integrity_check on the first read. Enlarge both buffers to hold MAX_TAG_SIZE bytes, as commit b93b6643e9b5 ("dm integrity: fix a crash with unusually large tag size") did for integrity_metadata. Note that this is not a security bug because the buffer overflow can only be triggered by root.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
fb0987682c629c1d2c476f35f6fde405a5e304a4 to < 3c7aad85aeb9e28386672e3a009aa2e61f751b86affectedfb0987682c629c1d2c476f35f6fde405a5e304a4 to < 4f0ee735dc68e3e6c4dd9a666d7f7047163c4165affectedfb0987682c629c1d2c476f35f6fde405a5e304a4 to < f49cd7820cd0a96f20e1aa2708adb002124e38a7affectedfb0987682c629c1d2c476f35f6fde405a5e304a4 to < 764b683a6180fd72c931c13fea98d383506a3475affected
Linux Linux
Default version status: affected
6.11affected0 to < 6.11unaffected6.12.114 to ≤ 6.12.*unaffected6.18.57 to ≤ 6.18.*unaffected7.2.11 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected