CVE-2024-57890

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-57890
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/346db03e9926ab7117ed9bf19665699c037c773c Patch
https://git.kernel.org/stable/c/42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608 Patch
https://git.kernel.org/stable/c/b3ef4ae713360501182695dd47d6b4f6e1a43eb8 Patch
https://git.kernel.org/stable/c/b92667f755749cf10d9ef1088865c555ae83ffb7 Patch
https://git.kernel.org/stable/c/c2f961c46ea0e5274c5c320d007c2dd949cf627a Patch
https://git.kernel.org/stable/c/c57721b24bd897338a81a0ca5fff41600f0f1ad1 Patch
https://git.kernel.org/stable/c/d0257e089d1bbd35c69b6c97ff73e3690ab149a9 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
History

21 Jan 2025, 17:41

Type Values Removed Values Added
CWE CWE-190
First Time Linux linux Kernel
Linux
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: RDMA/uverbs: Evitar problema de desbordamiento de enteros En la expresión "cmd.wqe_size * cmd.wr_count", ambas variables son valores u32 que provienen del usuario, por lo que la multiplicación puede provocar un encapsulamiento de enteros. Luego, pasamos el resultado a uverbs_request_next_ptr(), que también podría potencialmente encapsularse. La multiplicación "cmd.sge_count * sizeof(struct ib_uverbs_sge)" también puede desbordarse en sistemas de 32 bits, aunque está bien en sistemas de 64 bits. Este parche hace dos cosas. Primero, he reorganizado la condición en uverbs_request_next_ptr() para que la variable controlada por uso "len" esté en un lado de la comparación por sí misma sin ningún cálculo. Luego, he modificado todos los llamadores para usar size_mul() para las multiplicaciones.
CPE cpe:2.3:o:linux:linux_kernel:6.13:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.13:rc5:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
References () https://git.kernel.org/stable/c/346db03e9926ab7117ed9bf19665699c037c773c - () https://git.kernel.org/stable/c/346db03e9926ab7117ed9bf19665699c037c773c - Patch
References () https://git.kernel.org/stable/c/42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608 - () https://git.kernel.org/stable/c/42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608 - Patch
References () https://git.kernel.org/stable/c/b3ef4ae713360501182695dd47d6b4f6e1a43eb8 - () https://git.kernel.org/stable/c/b3ef4ae713360501182695dd47d6b4f6e1a43eb8 - Patch
References () https://git.kernel.org/stable/c/b92667f755749cf10d9ef1088865c555ae83ffb7 - () https://git.kernel.org/stable/c/b92667f755749cf10d9ef1088865c555ae83ffb7 - Patch
References () https://git.kernel.org/stable/c/c2f961c46ea0e5274c5c320d007c2dd949cf627a - () https://git.kernel.org/stable/c/c2f961c46ea0e5274c5c320d007c2dd949cf627a - Patch
References () https://git.kernel.org/stable/c/c57721b24bd897338a81a0ca5fff41600f0f1ad1 - () https://git.kernel.org/stable/c/c57721b24bd897338a81a0ca5fff41600f0f1ad1 - Patch
References () https://git.kernel.org/stable/c/d0257e089d1bbd35c69b6c97ff73e3690ab149a9 - () https://git.kernel.org/stable/c/d0257e089d1bbd35c69b6c97ff73e3690ab149a9 - Patch

15 Jan 2025, 13:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-01-15 13:15

Updated : 2025-01-21 17:41

NVD link : CVE-2024-57890

Mitre link : CVE-2024-57890

CVE.ORG link : CVE-2024-57890

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-190

Integer Overflow or Wraparound