In the Linux kernel, the following vulnerability has been resolved:
net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post()
qrtr_endpoint_post() validates an incoming packet with
if (!size || len != ALIGN(size, 4) + hdrlen)
goto err;
where size comes from the wire. On 32-bit, size_t is 32 bits and
ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check
passes and skb_put_data(skb, data + hdrlen, size) writes past the
hdrlen-sized skb and oopses the kernel. 64-bit is unaffected. This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB
Read in qrtr_endpoint_post"), which fixed only the 64-bit case.
Reject any size that cannot fit the buffer before the ALIGN.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/20054869770c7df060c5ecee3e8bbf9029c47191
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/22100a8f73d4ae4f17697dae93d4e2e1d283a6ec
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/242408b5b763c01288adf3113cbce84378a76e1a
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3665e644ea081c4624a1637023b0de3b29f4ae04
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/689b7267f8632b4661879dc323e26ebb60978afb
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7f72c285f6d3bf63968a0344beee8ab1b370198b
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b609f7f46916c6b05585ca82455077198a23770f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d0597074e99731fdad5593e4f6d056a3866f2cab
416baaa9-dc9f-4396-8d5f-8c081fb06d67