Executive brief
A vulnerability was identified in the Linux kernel's QLogic FastLinQ FCoE (qedf) driver. This component is responsible for managing high-speed storage networking connections. An attacker with high-level system privileges could trigger a system crash or instability, potentially leading to a denial of service.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the qedf_dbg_debug_cmd_write function within drivers/scsi/qedf/qedf_debugfs.c. The driver allocates a kernel buffer based on a user-provided 'count' and copies data from userspace using memdup_user. However, it fails to ensure the resulting string is NUL-terminated before passing it to kstrtouint. A local attacker with high privileges (required to access debugfs) can provide a non-terminated string to trigger an OOB read, potentially causing a kernel panic. The issue has been resolved by replacing memdup_user with memdup_user_nul in multiple stable kernel branches.
Affected products
- Linux Linux Kernel 4.11 to 4.19.316, 4.20 to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.8.12, 6.9 to 6.9.3
Timeline
- 2024-04-24: other: Vulnerability fixed in upstream source code
- 2024-06-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/177f43c6892e6055de6541fe9391a8a3d1f95fc9
- https://git.kernel.org/stable/c/1f84a2744ad813be23fc4be99fb74bfb24aadb95
- https://git.kernel.org/stable/c/4907f5ad246fa9b51093ed7dfc7da9ebbd3f20b8
- https://git.kernel.org/stable/c/563e609275927c0b75fbfd0d90441543aa7b5e0d
- https://git.kernel.org/stable/c/769b9fd2af02c069451fe9108dba73355d9a021c
- https://git.kernel.org/stable/c/a75001678e1d38aa607d5b898ec7ff8ed0700d59
- https://git.kernel.org/stable/c/d0184a375ee797eb657d74861ba0935b6e405c62