Към съдържанието
Търсене

CVE-2026-43407: Linux, грешка в паметта

9.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a message is stored in a variable of type int. A value greater than INT_MAX leads to an integer overflow and is interpreted as a negative value. This leads to decrementing the pointer address by this value and subsequently accessing it because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. This patch fixes the issue by changing the data type of payload_len to u32. Additionally, the data type of result_msg_len is changed to u32, as it is also a variable holding a non-negative length. Also, an additional layer of sanity checks is introduced, ensuring that directly after reading it from the message, payload_len and result_msg_len are not greater than the overall segment length. BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph] Read of size 4 at addr ffff88811404df14 by task kworker/20:1/262 CPU: 20 UID: 0 PID: 262 Comm: kworker/20:1 Not tainted 6.19.2 #5 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: ceph-msgr ceph_con_workfn [libceph] Call Trace: <TASK> dump_stack_lvl+0x76/0xa0 print_report+0xd1/0x620 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? kasan_complete_mode_report_info+0x72/0x210 kasan_report+0xe7/0x130 ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] ? ceph_handle_auth_reply+0x642/0x7a0 [libceph] __asan_report_load_n_noabort+0xf/0x20 ceph_handle_auth_reply+0x642/0x7a0 [libceph] mon_dispatch+0x973/0x23d0 [libceph] ? apparmor_socket_recvmsg+0x6b/0xa0 ? __pfx_mon_dispatch+0x10/0x10 [libceph] ? __kasan_check_write+0x14/0x30i ? mutex_unlock+0x7f/0x

Засегнати продукти

  • Linux Linux: 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди ea080b21092590122c3f971cf588932cdbf47847; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди edc678e5cd11730a2834b43071d8923f05bc334d; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди 6cee34d6669fe176b4259131adb1a145c939b472; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди 8bb87547e92dcf0928ed763c60e0ac8d733c3656; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди ed024d2f4c79c0eb2464df0fb640610ac301f9a0; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди f9da5c1bbac5c8e33259fe00ed7347438fffa969; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди 9f9e2297f45fc2d2524eb104c289d69ddef95665; 4e7a5dcd1bbab6560fbc8ada29a840e7a20ed7bc преди b282c43ed156ae15ea76748fc15cd5c39dc9ab72
  • Linux Linux: 2.6.34; преди 2.6.34; 5.10.253 до 5.10.*; 5.15.203 до 5.15.*; 6.1.167 до 6.1.*; 6.6.130 до 6.6.*; 6.12.78 до 6.12.*; 6.18.19 до 6.18.*; 6.19.9 до 6.19.*; от 7.0 нататък

Вид слабост

История

  • 8 май 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-43407: Linux, грешка в паметта | freedomonline.bg