In the Linux kernel, the following vulnerability has been resolved:
RDMA/uverbs: Prevent integer overflow issue
In the expression "cmd.wqesize * cmd.wrcount", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbsrequestnextptr() which also could potentially wrap. The "cmd.sgecount * sizeof(struct ibuverbssge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems.
This patch does two things. First, I've re-arranged the condition in uverbsrequestnextptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use sizemul() for the multiplications.
[
{
"id": "CVE-2024-57890-14442597",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"60003809766894367476584123948259628085",
"266300107023608108014699502282829351674",
"262110688855036048170544350374410254643",
"61848953031192276867107246079045988491",
"36166064789902927658979210487769018124",
"197211151996604577466719668159220201982",
"274195114096700784215136588569481403955",
"273411168391444778813404515826359993850",
"246223470113169380943336183278158244570",
"308338088791088267741419903526618667502",
"31882502234979612317445601377067075531",
"41299135689202044987888109482018585829",
"192904111340567529184782154307481730917",
"74972923449778173687847004564138305017",
"256354515501975480324343477680140933417",
"83962299877336148135700141036804878240",
"267123479564120788450499099163654068064",
"323204230585670818041457225078878787867",
"182403244826972530451107754377540268785",
"126099919271585792793196971367155454633"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0257e089d1bbd35c69b6c97ff73e3690ab149a9"
},
{
"id": "CVE-2024-57890-1531a021",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"60003809766894367476584123948259628085",
"266300107023608108014699502282829351674",
"262110688855036048170544350374410254643",
"61848953031192276867107246079045988491",
"36166064789902927658979210487769018124",
"197211151996604577466719668159220201982",
"274195114096700784215136588569481403955",
"273411168391444778813404515826359993850",
"246223470113169380943336183278158244570",
"308338088791088267741419903526618667502",
"31882502234979612317445601377067075531",
"41299135689202044987888109482018585829",
"192904111340567529184782154307481730917",
"74972923449778173687847004564138305017",
"256354515501975480324343477680140933417",
"83962299877336148135700141036804878240",
"267123479564120788450499099163654068064",
"323204230585670818041457225078878787867",
"182403244826972530451107754377540268785",
"126099919271585792793196971367155454633"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608"
},
{
"id": "CVE-2024-57890-161a8a5b",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1719.0,
"function_hash": "295438860661459802110822933590764059564"
},
"target": {
"function": "ib_uverbs_unmarshall_recv",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b92667f755749cf10d9ef1088865c555ae83ffb7"
},
{
"id": "CVE-2024-57890-1660d7ef",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1719.0,
"function_hash": "295438860661459802110822933590764059564"
},
"target": {
"function": "ib_uverbs_unmarshall_recv",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0257e089d1bbd35c69b6c97ff73e3690ab149a9"
},
{
"id": "CVE-2024-57890-18dcc68d",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"60003809766894367476584123948259628085",
"266300107023608108014699502282829351674",
"262110688855036048170544350374410254643",
"61848953031192276867107246079045988491",
"36166064789902927658979210487769018124",
"197211151996604577466719668159220201982",
"274195114096700784215136588569481403955",
"273411168391444778813404515826359993850",
"246223470113169380943336183278158244570",
"308338088791088267741419903526618667502",
"31882502234979612317445601377067075531",
"41299135689202044987888109482018585829",
"192904111340567529184782154307481730917",
"74972923449778173687847004564138305017",
"256354515501975480324343477680140933417",
"83962299877336148135700141036804878240",
"267123479564120788450499099163654068064",
"323204230585670818041457225078878787867",
"182403244826972530451107754377540268785",
"126099919271585792793196971367155454633"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b92667f755749cf10d9ef1088865c555ae83ffb7"
},
{
"id": "CVE-2024-57890-1a716975",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 4037.0,
"function_hash": "29522383618932738625729499478078838217"
},
"target": {
"function": "ib_uverbs_post_send",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b92667f755749cf10d9ef1088865c555ae83ffb7"
},
{
"id": "CVE-2024-57890-1a90575c",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 223.0,
"function_hash": "98422683539660264579710616394327015094"
},
"target": {
"function": "uverbs_request_next_ptr",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef4ae713360501182695dd47d6b4f6e1a43eb8"
},
{
"id": "CVE-2024-57890-1ad50513",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 223.0,
"function_hash": "98422683539660264579710616394327015094"
},
"target": {
"function": "uverbs_request_next_ptr",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2f961c46ea0e5274c5c320d007c2dd949cf627a"
},
{
"id": "CVE-2024-57890-1c6ca9aa",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1719.0,
"function_hash": "295438860661459802110822933590764059564"
},
"target": {
"function": "ib_uverbs_unmarshall_recv",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@346db03e9926ab7117ed9bf19665699c037c773c"
},
{
"id": "CVE-2024-57890-1dfd237a",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 223.0,
"function_hash": "98422683539660264579710616394327015094"
},
"target": {
"function": "uverbs_request_next_ptr",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@346db03e9926ab7117ed9bf19665699c037c773c"
},
{
"id": "CVE-2024-57890-23a81d92",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 223.0,
"function_hash": "98422683539660264579710616394327015094"
},
"target": {
"function": "uverbs_request_next_ptr",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c57721b24bd897338a81a0ca5fff41600f0f1ad1"
},
{
"id": "CVE-2024-57890-2c171426",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 4037.0,
"function_hash": "29522383618932738625729499478078838217"
},
"target": {
"function": "ib_uverbs_post_send",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608"
},
{
"id": "CVE-2024-57890-37be3386",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"60003809766894367476584123948259628085",
"266300107023608108014699502282829351674",
"262110688855036048170544350374410254643",
"61848953031192276867107246079045988491",
"36166064789902927658979210487769018124",
"197211151996604577466719668159220201982",
"274195114096700784215136588569481403955",
"273411168391444778813404515826359993850",
"246223470113169380943336183278158244570",
"308338088791088267741419903526618667502",
"31882502234979612317445601377067075531",
"41299135689202044987888109482018585829",
"192904111340567529184782154307481730917",
"74972923449778173687847004564138305017",
"256354515501975480324343477680140933417",
"83962299877336148135700141036804878240",
"267123479564120788450499099163654068064",
"323204230585670818041457225078878787867",
"182403244826972530451107754377540268785",
"126099919271585792793196971367155454633"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@346db03e9926ab7117ed9bf19665699c037c773c"
},
{
"id": "CVE-2024-57890-424afd15",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1719.0,
"function_hash": "295438860661459802110822933590764059564"
},
"target": {
"function": "ib_uverbs_unmarshall_recv",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2f961c46ea0e5274c5c320d007c2dd949cf627a"
},
{
"id": "CVE-2024-57890-4f5dc335",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 223.0,
"function_hash": "98422683539660264579710616394327015094"
},
"target": {
"function": "uverbs_request_next_ptr",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0257e089d1bbd35c69b6c97ff73e3690ab149a9"
},
{
"id": "CVE-2024-57890-5085a646",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"60003809766894367476584123948259628085",
"266300107023608108014699502282829351674",
"262110688855036048170544350374410254643",
"61848953031192276867107246079045988491",
"36166064789902927658979210487769018124",
"197211151996604577466719668159220201982",
"274195114096700784215136588569481403955",
"273411168391444778813404515826359993850",
"246223470113169380943336183278158244570",
"308338088791088267741419903526618667502",
"31882502234979612317445601377067075531",
"41299135689202044987888109482018585829",
"192904111340567529184782154307481730917",
"74972923449778173687847004564138305017",
"256354515501975480324343477680140933417",
"83962299877336148135700141036804878240",
"267123479564120788450499099163654068064",
"323204230585670818041457225078878787867",
"182403244826972530451107754377540268785",
"126099919271585792793196971367155454633"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef4ae713360501182695dd47d6b4f6e1a43eb8"
},
{
"id": "CVE-2024-57890-65b282df",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1719.0,
"function_hash": "295438860661459802110822933590764059564"
},
"target": {
"function": "ib_uverbs_unmarshall_recv",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef4ae713360501182695dd47d6b4f6e1a43eb8"
},
{
"id": "CVE-2024-57890-6c173643",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 4037.0,
"function_hash": "29522383618932738625729499478078838217"
},
"target": {
"function": "ib_uverbs_post_send",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2f961c46ea0e5274c5c320d007c2dd949cf627a"
},
{
"id": "CVE-2024-57890-825b47ba",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 3983.0,
"function_hash": "148705625573419980191570823558222118768"
},
"target": {
"function": "ib_uverbs_post_send",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c57721b24bd897338a81a0ca5fff41600f0f1ad1"
},
{
"id": "CVE-2024-57890-890a6266",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 4037.0,
"function_hash": "29522383618932738625729499478078838217"
},
"target": {
"function": "ib_uverbs_post_send",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b3ef4ae713360501182695dd47d6b4f6e1a43eb8"
},
{
"id": "CVE-2024-57890-930e4c20",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 4037.0,
"function_hash": "29522383618932738625729499478078838217"
},
"target": {
"function": "ib_uverbs_post_send",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d0257e089d1bbd35c69b6c97ff73e3690ab149a9"
},
{
"id": "CVE-2024-57890-93e4389a",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1707.0,
"function_hash": "10345026850438482022680991441748135656"
},
"target": {
"function": "ib_uverbs_unmarshall_recv",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608"
},
{
"id": "CVE-2024-57890-ad45ca0e",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"60003809766894367476584123948259628085",
"266300107023608108014699502282829351674",
"262110688855036048170544350374410254643",
"61848953031192276867107246079045988491",
"36166064789902927658979210487769018124",
"197211151996604577466719668159220201982",
"274195114096700784215136588569481403955",
"273411168391444778813404515826359993850",
"246223470113169380943336183278158244570",
"308338088791088267741419903526618667502",
"31882502234979612317445601377067075531",
"41299135689202044987888109482018585829",
"192904111340567529184782154307481730917",
"74972923449778173687847004564138305017",
"256354515501975480324343477680140933417",
"83962299877336148135700141036804878240",
"267123479564120788450499099163654068064",
"323204230585670818041457225078878787867",
"182403244826972530451107754377540268785",
"126099919271585792793196971367155454633"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c2f961c46ea0e5274c5c320d007c2dd949cf627a"
},
{
"id": "CVE-2024-57890-afee292a",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 1707.0,
"function_hash": "10345026850438482022680991441748135656"
},
"target": {
"function": "ib_uverbs_unmarshall_recv",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c57721b24bd897338a81a0ca5fff41600f0f1ad1"
},
{
"id": "CVE-2024-57890-bd3dab23",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"60003809766894367476584123948259628085",
"266300107023608108014699502282829351674",
"262110688855036048170544350374410254643",
"61848953031192276867107246079045988491",
"36166064789902927658979210487769018124",
"197211151996604577466719668159220201982",
"274195114096700784215136588569481403955",
"273411168391444778813404515826359993850",
"246223470113169380943336183278158244570",
"308338088791088267741419903526618667502",
"31882502234979612317445601377067075531",
"41299135689202044987888109482018585829",
"192904111340567529184782154307481730917",
"74972923449778173687847004564138305017",
"256354515501975480324343477680140933417",
"83962299877336148135700141036804878240",
"267123479564120788450499099163654068064",
"323204230585670818041457225078878787867",
"182403244826972530451107754377540268785",
"126099919271585792793196971367155454633"
],
"threshold": 0.9
},
"target": {
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Line",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c57721b24bd897338a81a0ca5fff41600f0f1ad1"
},
{
"id": "CVE-2024-57890-cf7f4076",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 223.0,
"function_hash": "98422683539660264579710616394327015094"
},
"target": {
"function": "uverbs_request_next_ptr",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b92667f755749cf10d9ef1088865c555ae83ffb7"
},
{
"id": "CVE-2024-57890-dbe84687",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 4037.0,
"function_hash": "29522383618932738625729499478078838217"
},
"target": {
"function": "ib_uverbs_post_send",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@346db03e9926ab7117ed9bf19665699c037c773c"
},
{
"id": "CVE-2024-57890-fee38897",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 223.0,
"function_hash": "98422683539660264579710616394327015094"
},
"target": {
"function": "uverbs_request_next_ptr",
"file": "drivers/infiniband/core/uverbs_cmd.c"
},
"signature_type": "Function",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608"
}
]