5.5

CVE-2024-57890

RDMA/uverbs: Prevent integer overflow issue

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Prevent integer overflow issue

In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32
values that come from the user so the multiplication can lead to integer
wrapping.  Then we pass the result to uverbs_request_next_ptr() which also
could potentially wrap.  The "cmd.sge_count * sizeof(struct ib_uverbs_sge)"
multiplication can also overflow on 32bit systems although it's fine on
64bit systems.

This patch does two things.  First, I've re-arranged the condition in
uverbs_request_next_ptr() so that the use controlled variable "len" is on
one side of the comparison by itself without any math.  Then I've modified
all the callers to use size_mul() for the multiplications.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.15 < 5.4.289
Linux ≫ Linux Kernel Version >= 5.5 < 5.10.233
Linux ≫ Linux Kernel Version >= 5.11 < 5.15.176
Linux ≫ Linux Kernel Version >= 5.16 < 6.1.124
Linux ≫ Linux Kernel Version >= 6.2 < 6.6.70
Linux ≫ Linux Kernel Version >= 6.7 < 6.12.9
Linux ≫ Linux Kernel Version6.13 Updaterc1
Linux ≫ Linux Kernel Version6.13 Updaterc2
Linux ≫ Linux Kernel Version6.13 Updaterc3
Linux ≫ Linux Kernel Version6.13 Updaterc4
Linux ≫ Linux Kernel Version6.13 Updaterc5
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.107
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
134c704f-9b21-4f2e-91b3-4a467353bcc0 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

https://git.kernel.org/stable/c/346db03e9926ab7117ed9bf19665699c037c773c
Patch
https://git.kernel.org/stable/c/42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608
Patch
https://git.kernel.org/stable/c/b3ef4ae713360501182695dd47d6b4f6e1a43eb8
Patch
https://git.kernel.org/stable/c/b92667f755749cf10d9ef1088865c555ae83ffb7
Patch
https://git.kernel.org/stable/c/c2f961c46ea0e5274c5c320d007c2dd949cf627a
Patch
https://git.kernel.org/stable/c/c57721b24bd897338a81a0ca5fff41600f0f1ad1
Patch
https://git.kernel.org/stable/c/d0257e089d1bbd35c69b6c97ff73e3690ab149a9
Patch
https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00002.html