In the Linux kernel, the following vulnerability has been resolved:
RDMA/srpt: fix integer overflow in immediate data length check
imm_buf->len is a user-controlled uint32_t received from the network.
Adding it to imm_data_offset without overflow checking allows a
malicious initiator to send len=0xFFFFFFFF, causing req_size to wrap
around to a small value, bypassing the bounds check, and subsequently
passing a ~4GB length to sg_init_one().
Use check_add_overflow() to detect wrapping before the comparison.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/067b9556eeb007f28b7c2033b4dcde5b6d88418f
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/07dec3f6dcb6c6cc891162d252b800eb0e6d5e8e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3efa5301137140a3ca3677a9098c0a93a0acfd49
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/65572fbd86033ae2370125593d59b8be34253aaf
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/72497172a4799119a0282a5eb5e2b8ddcc821921
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c82c860f8c8e4f4f454c9f14d0ad0c0466965f7d
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/dcf7a986f377cce0749ed53f1d64195fbd5fdf91
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/eb4ecdf631fe00e8020bf461503cb9b7017ed796
416baaa9-dc9f-4396-8d5f-8c081fb06d67