In the Linux kernel, the following vulnerability has been resolved:
vduse: fix memory corruption in vduse_dev_ioctl()
The “config.offset” comes from the user. There needs to a check to
prevent it being out of bounds. The “config.offset” and
“dev->config_size” variables are both type u32. So if the offset if
out of bounds then the “dev->config_size - config.offset” subtraction
results in a very high u32 value. The out of bounds offset can result
in memory corruption.
[
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "unaffected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/vdpa/vdpa_user/vduse_dev.c"
],
"versions": [
{
"version": "c8a6153b6c59",
"lessThan": "e6c67560b434",
"status": "affected",
"versionType": "git"
},
{
"version": "c8a6153b6c59",
"lessThan": "ff9f9c6e7484",
"status": "affected",
"versionType": "git"
}
]
},
{
"product": "Linux",
"vendor": "Linux",
"defaultStatus": "affected",
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"programFiles": [
"drivers/vdpa/vdpa_user/vduse_dev.c"
],
"versions": [
{
"version": "5.15",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.15",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.15.11",
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"versionType": "custom"
},
{
"version": "5.16",
"lessThanOrEqual": "*",
"status": "unaffected",
"versionType": "original_commit_for_fix"
}
]
}
]