Skip to content

Commit 247d450

Browse files
committed
Merge: scsi: qedf: Ensure the copied buf is NUL terminated
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/4807 JIRA: https://issues.redhat.com/browse/RHEL-44202 JIRA: https://issues.redhat.com/browse/RHEL-44201 CVE: CVE-2024-38559 Currently, we allocate a count-sized kernel buffer and copy count from userspace to that buffer. Later, we use kstrtouint on this buffer but we don't ensure that the string is terminated inside the buffer, this can lead to OOB read when using kstrtouint. Fix this issue by using memdup_user_nul instead of memdup_user. Signed-off-by: John Meneghini <jmeneghi@redhat.com> Approved-by: Maurizio Lombardi <mlombard@redhat.com> Approved-by: Chris Leech <cleech@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Lucas Zampieri <lzampier@redhat.com>
2 parents a208fd3 + 753f870 commit 247d450

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/scsi/qedf/qedf_debugfs.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,7 +170,7 @@ qedf_dbg_debug_cmd_write(struct file *filp, const char __user *buffer,
170170
if (!count || *ppos)
171171
return 0;
172172

173-
kern_buf = memdup_user(buffer, count);
173+
kern_buf = memdup_user_nul(buffer, count);
174174
if (IS_ERR(kern_buf))
175175
return PTR_ERR(kern_buf);
176176

0 commit comments

Comments
 (0)