Към съдържанието
Търсене

CVE-2026-64320: Linux, грешка в паметта

9.1

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, без вход и без действие от потребителя.

CVE радар: още уязвимости от този вид

  • Експлоатация: няма данни за експлоатация
  • Атаката може да се автоматизира

Описание

Оригинално описание

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page nvmet_execute_disc_get_log_page() validates only the dword alignment of the host-supplied Log Page Offset (lpo). The 64-bit offset is then added to a small kzalloc'd buffer that holds the discovery log page and the result is passed straight to nvmet_copy_to_sgl(), which memcpy()s data_len bytes out to the host with no source-side bound check: u64 offset = nvmet_get_log_page_offset(req->cmd); /* 64-bit host */ size_t data_len = nvmet_get_log_page_len(req->cmd); /* 32-bit host */ ... if (offset & 0x3) { ... } /* only check */ ... alloc_len = sizeof(*hdr) + entry_size * discovery_log_entries(req); buffer = kzalloc(alloc_len, GFP_KERNEL); ... status = nvmet_copy_to_sgl(req, 0, buffer + offset, data_len); The Discovery controller is unauthenticated -- nvmet_host_allowed() returns true unconditionally for the discovery subsystem -- so the call is reachable pre-authentication by any TCP/RDMA/FC peer that can reach the nvmet target. With a discovery log page of ~1 KiB, an attacker requesting up to 4 KiB starting at offset == alloc_len reads the next slab page out and gets its content returned over the fabric (an empirical run on a default nvmet-tcp loopback target leaked 81 canonical kernel pointers in one Get Log Page response). Pointing the offset at unmapped kernel memory faults the in-kernel memcpy and crashes (or panics, on panic_on_oops=1) the target host instead. The attacker-controlled source-side offset pattern "nvmet_copy_to_sgl(req, 0, buffer + ATTACKER_OFFSET, ...)" is unique to nvmet_execute_disc_get_log_page in the entire nvmet codebase: every other Get Log Page handler in admin-cmd.c either ignores lpo (and silently starts every response at offset 0) or tracks a local destination offset with a fixed source pointer. Validate the host-supplie

Засегнати продукти

  • Linux Linux: a07b4970f464f13640e28e16dad6cfa33647cc99 преди ff815b5e8688dcf68529b7f0fde8de5847f63f1e; a07b4970f464f13640e28e16dad6cfa33647cc99 преди 8ae9bb92fc9a712a8d32da9c5fd657101f9b260b; a07b4970f464f13640e28e16dad6cfa33647cc99 преди 33b974eb626154ae9348f2bac7de84cb2a3d9dd4; a07b4970f464f13640e28e16dad6cfa33647cc99 преди 56c021a0869260d04c4b65d1471936aaf9177114; a07b4970f464f13640e28e16dad6cfa33647cc99 преди a29b316b9bbfd269f323ab4ba9906a894025680f; a07b4970f464f13640e28e16dad6cfa33647cc99 преди 53cd102a7a56079b11b897835bd9b94c14e6322c
  • Linux Linux: 4.8; преди 4.8; 6.1.191 до 6.1.*; 6.6.160 до 6.6.*; 6.12.96 до 6.12.*; 6.18.39 до 6.18.*; 7.1.4 до 7.1.*; от 7.2 нататък

Вид слабост

История

  • 25 юли 2026 Публикувано

Други уязвимости в Linux Linux

Първоизточници

CVE-2026-64320: Linux, грешка в паметта | freedomonline.bg