In the Linux kernel, the following vulnerability has been resolved:
block/rnbd-srv: Check for unlikely string overflow
Since "devsearchpath" can technically be as large as PATHMAX, there was a risk of truncation when copying it and a second string into "fullpath" since it was also PATH_MAX sized. The W=1 builds were reporting this warning:
drivers/block/rnbd/rnbd-srv.c: In function 'processmsgopen.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(fullpath, PATHMAX, "%s/%s", | ^~ In function 'rnbdsrvgetfullpath', inlined from 'processmsgopen.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(fullpath, PATHMAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | devsearchpath, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~
To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present).
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b9ea86e662035a886ccb5c76d56793cba618827",
"deprecated": false,
"id": "CVE-2023-52618-0c3a4464",
"target": {
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"273330646699201112440123503876456027403",
"65542742487519124618334681437205032393",
"324861093457860170078311844096904057350",
"199832120436666020836970245363701954533",
"337880496289701797506017679365828017265",
"266327908189811319400985145182073188446",
"27249522987068765305915968661272998418",
"204102069374967736240146855889026619209",
"277468530507599044862950400118054711485",
"144287318937591180959226178676720841913",
"212932869080492948558330942555927579845",
"81485238067882666490670004843000713276",
"68374074080408453727350143800440497164",
"127609721231203289631029913564289168863",
"32221220453907125721865314686231347005",
"234161195564956127159780872442163473482",
"130526047687878395557535608912008536453",
"7708785792748706102119562447211426549",
"238977144048856442525082886383734206144"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2c6206f18104fba7f887bf4dbbfe4c41adc4339",
"deprecated": false,
"id": "CVE-2023-52618-2ac98da1",
"target": {
"function": "rnbd_srv_get_full_path",
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"function_hash": "23893020271752186270194835550418736937",
"length": 868.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5b9ea86e662035a886ccb5c76d56793cba618827",
"deprecated": false,
"id": "CVE-2023-52618-2cd49ee0",
"target": {
"function": "rnbd_srv_get_full_path",
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"function_hash": "23893020271752186270194835550418736937",
"length": 868.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6abd5e17da33eba15df2bddc93413e76c2b55f7",
"deprecated": false,
"id": "CVE-2023-52618-6335da52",
"target": {
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"273330646699201112440123503876456027403",
"65542742487519124618334681437205032393",
"324861093457860170078311844096904057350",
"199832120436666020836970245363701954533",
"337880496289701797506017679365828017265",
"266327908189811319400985145182073188446",
"27249522987068765305915968661272998418",
"204102069374967736240146855889026619209",
"277468530507599044862950400118054711485",
"144287318937591180959226178676720841913",
"212932869080492948558330942555927579845",
"81485238067882666490670004843000713276",
"68374074080408453727350143800440497164",
"127609721231203289631029913564289168863",
"32221220453907125721865314686231347005",
"234161195564956127159780872442163473482",
"130526047687878395557535608912008536453",
"7708785792748706102119562447211426549",
"238977144048856442525082886383734206144"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41",
"deprecated": false,
"id": "CVE-2023-52618-647082c9",
"target": {
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"273330646699201112440123503876456027403",
"65542742487519124618334681437205032393",
"324861093457860170078311844096904057350",
"199832120436666020836970245363701954533",
"337880496289701797506017679365828017265",
"266327908189811319400985145182073188446",
"27249522987068765305915968661272998418",
"204102069374967736240146855889026619209",
"277468530507599044862950400118054711485",
"144287318937591180959226178676720841913",
"212932869080492948558330942555927579845",
"81485238067882666490670004843000713276",
"68374074080408453727350143800440497164",
"127609721231203289631029913564289168863",
"32221220453907125721865314686231347005",
"234161195564956127159780872442163473482",
"130526047687878395557535608912008536453",
"7708785792748706102119562447211426549",
"238977144048856442525082886383734206144"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f6abd5e17da33eba15df2bddc93413e76c2b55f7",
"deprecated": false,
"id": "CVE-2023-52618-6d5ff486",
"target": {
"function": "rnbd_srv_get_full_path",
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"function_hash": "23893020271752186270194835550418736937",
"length": 868.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9e4bf6a08d1e127bcc4bd72557f2dfafc6bc7f41",
"deprecated": false,
"id": "CVE-2023-52618-79831318",
"target": {
"function": "rnbd_srv_get_full_path",
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"function_hash": "23893020271752186270194835550418736937",
"length": 868.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95bc866c11974d3e4a9d922275ea8127ff809cf7",
"deprecated": false,
"id": "CVE-2023-52618-941f9d5a",
"target": {
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"273330646699201112440123503876456027403",
"65542742487519124618334681437205032393",
"324861093457860170078311844096904057350",
"199832120436666020836970245363701954533",
"337880496289701797506017679365828017265",
"266327908189811319400985145182073188446",
"27249522987068765305915968661272998418",
"204102069374967736240146855889026619209",
"277468530507599044862950400118054711485",
"144287318937591180959226178676720841913",
"212932869080492948558330942555927579845",
"81485238067882666490670004843000713276",
"68374074080408453727350143800440497164",
"127609721231203289631029913564289168863",
"32221220453907125721865314686231347005",
"234161195564956127159780872442163473482",
"130526047687878395557535608912008536453",
"7708785792748706102119562447211426549",
"238977144048856442525082886383734206144"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a2c6206f18104fba7f887bf4dbbfe4c41adc4339",
"deprecated": false,
"id": "CVE-2023-52618-99b476a5",
"target": {
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"273330646699201112440123503876456027403",
"65542742487519124618334681437205032393",
"324861093457860170078311844096904057350",
"199832120436666020836970245363701954533",
"337880496289701797506017679365828017265",
"266327908189811319400985145182073188446",
"27249522987068765305915968661272998418",
"204102069374967736240146855889026619209",
"277468530507599044862950400118054711485",
"144287318937591180959226178676720841913",
"212932869080492948558330942555927579845",
"81485238067882666490670004843000713276",
"68374074080408453727350143800440497164",
"127609721231203289631029913564289168863",
"32221220453907125721865314686231347005",
"234161195564956127159780872442163473482",
"130526047687878395557535608912008536453",
"7708785792748706102119562447211426549",
"238977144048856442525082886383734206144"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af7bbdac89739e2e7380387fda598848d3b7010f",
"deprecated": false,
"id": "CVE-2023-52618-b0a84be3",
"target": {
"function": "rnbd_srv_get_full_path",
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"function_hash": "23893020271752186270194835550418736937",
"length": 868.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@95bc866c11974d3e4a9d922275ea8127ff809cf7",
"deprecated": false,
"id": "CVE-2023-52618-dc5696db",
"target": {
"function": "rnbd_srv_get_full_path",
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"function_hash": "23893020271752186270194835550418736937",
"length": 868.0
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af7bbdac89739e2e7380387fda598848d3b7010f",
"deprecated": false,
"id": "CVE-2023-52618-e1b453f5",
"target": {
"file": "drivers/block/rnbd/rnbd-srv.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"273330646699201112440123503876456027403",
"65542742487519124618334681437205032393",
"324861093457860170078311844096904057350",
"199832120436666020836970245363701954533",
"337880496289701797506017679365828017265",
"266327908189811319400985145182073188446",
"27249522987068765305915968661272998418",
"204102069374967736240146855889026619209",
"277468530507599044862950400118054711485",
"144287318937591180959226178676720841913",
"212932869080492948558330942555927579845",
"81485238067882666490670004843000713276",
"68374074080408453727350143800440497164",
"127609721231203289631029913564289168863",
"32221220453907125721865314686231347005",
"234161195564956127159780872442163473482",
"130526047687878395557535608912008536453",
"7708785792748706102119562447211426549",
"238977144048856442525082886383734206144"
]
},
"signature_type": "Line"
}
]