[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <20150521153131.E2ACF132E85C@smtpvbsrv1.mitre.org>
Date: Thu, 21 May 2015 11:31:31 -0400 (EDT)
From: cve-assign@...re.org
To: wmealing@...hat.com
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request for vhost/scsi possible memory corruption.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c816c1f24df0204e01851431d3bab3eb76719c
>
> -- vhost/scsi: potential memory corruption
> This code in vhost_scsi_make_tpg() is confusing because we limit "tpgt"
> to UINT_MAX but the data type of "tpg->tport_tpgt" and that is a u16.
>
> I looked at the context and it turns out that in
> vhost_scsi_set_endpoint(), "tpg->tport_tpgt" is used as an offset into
> the vs_tpg[] array which has VHOST_SCSI_MAX_TARGET (256) elements so
> anything higher than 255 then it is invalid. I have made that the limit
> now.
>
> In vhost_scsi_send_evt() we mask away values higher than 255, but now
> that the limit has changed, we don't need the mask.
> --
> The first check that slips past is here:
>
> -- drivers/vhost/scsi.c - vhost_scsi_make_tpg()
>
> if (vs->vs_tpg && vs->vs_tpg[tpg->tport_tpgt])
>
> My theory is that the possible memory corruption happens later:
>
> -- drivers/vhost/scsi.c - vhost_scsi_make_tpg()
>
> // sets this null pointer, to "tpg" value.
> vs_tpg[tpg->tport_tpgt] = tpg;
>
> When vs_tpg[tpg->tport_tpgt] = 0
Nobody else has offered an alternative theory or shown that it is
unexploitable, so probably a CVE ID is reasonable. Use CVE-2015-4036.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVXfnpAAoJEKllVAevmvmsJSkH+wQyE2BCazl50a+4lscyN/S/
mLdpNddqLuaCPEWOwFcp8UX2M/d5Uyj4zl42bsfFOy0HA6zBmUAzjeg9Ea3b8gQp
ix4guXREeWkmaw+IT5uyG8dCSujMSTzvdDKvXoCh2jcyvdSXXb4xcHIlsmppgn8M
8hVRXoAuEt8yrbtjzXA99pB6gYJeKTOsZFPx0Fwy2aeCO/tCVUoZF+KlUGxokvWL
wRhl9JBdKxmqzMgZcuDUdgZ9s9TGpFIChVOKvDHdw52pL8eXMEqzD1JV2NbQGG3C
Xa/LmM2wCE/eqnYT7QSlzEjh2e1titJkNUc+wVNj4Refj/k1HXCCQdVZNOWnbh8=
=voYF
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
