In the Linux kernel, the following vulnerability has been resolved:
crypto: ccp - Fix snp_filter_reserved_mem_regions() off-by-one
Sashiko notes:
> regarding the bounds check in snp_filter_reserved_mem_regions()
> called via walk_iomem_res_desc(): does the check
> if ((range_list->num_elements * 16 + 8) > PAGE_SIZE)
> allow an off-by-one heap buffer overflow?
>
> If range_list->num_elements is 255, 255 * 16 + 8 = 4088, which is <= 4096.
> Writing range->base (8 bytes) fills 4088-4095, but writing range->page_count
> (4 bytes) would write to 4096-4099, overflowing the kzalloc-allocated
> PAGE_SIZE buffer.
Fix this by accounting for the entry about to be written to, in addition to
the entries that are already allocated.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 4
https://git.kernel.org/stable/c/1b864b6cb213bbd7b406e9b2e98c962077f300df
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/830c1f3e71989448652973375ef5e39b6ede47a3
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/af7341616b742ad2c374a90998bd650a035f694d
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/c5c79d92da0f9a09f48be5e2aabed2d6d1a96294
416baaa9-dc9f-4396-8d5f-8c081fb06d67