CVE-2024-57890
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications.
How to fix
- linux linux_kernel5.4.289, 5.10.233, 5.15.176, 6.1.124, 6.6.70, 6.12.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | 2.6.15 ≤ v < 5.4.289, 5.5 ≤ v < 5.10.233, 5.11 ≤ v < 5.15.176, 5.16 ≤ v < 6.1.124, 6.2 ≤ v < 6.6.70, 6.7 ≤ v < 6.12.9, 6.13 | 5.4.289, 5.10.233, 5.15.176, 6.1.124, 6.6.70, 6.12.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.