Entreprise française de cybersécurité depuis 2004
☎ 03 60 47 09 81 - info@securiteinfo.com
☎ 03 60 47 09 81 - info@securiteinfo.com
In the Linux kernel, the following vulnerability has been resolved:mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systemsThe following two shared buffer operations make use of the Shared BufferStatus Register (SBSR): # devlink sb occupancy snapshot pci/0000:01:00.0 # devlink sb occupancy clearmax pci/0000:01:00.0The register has two masks of 256 bits to denote on which ingress /egress ports the register should operate on. Spectrum-4 has more than256 ports, so the register was extended by cited commit with a new'port_page' field.However, when filling the register's payload, the driver specifies theports as absolute numbers and not relative to the first port of the portpage, resulting in memory corruptions [1].Fix by specifying the ports relative to the first port of the port page.[1]BUG: KASAN: slab-use-after-free in mlxsw_sp_sb_occ_snapshot+0xb6d/0xbc0Read of size 1 at addr ffff8881068cb00f by task devlink/1566[...]Call Trace:
No PoCs from references.
- https://github.com/fkie-cad/nvd-json-data-feeds