PT-2026-61203 · Linux · Linux
CVE-2026-63886
·
Publicado
2026-07-19
·
Atualizado
2026-07-19
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Validate CHAP R length before base64 decode
chap server compute hash() allocates client digest as
kzalloc(chap->digest size) and then, for BASE64-encoded responses,
passes chap r directly to chap base64 decode() without checking whether
the input length could produce more than digest size bytes of output.
chap base64 decode() writes to the destination unconditionally as long
as there is input to consume. With MAX RESPONSE LENGTH set to 128 and
the "0b" prefix stripped by extract param(), up to 127 base64 characters
can reach the decoder. 127 characters decode to 95 bytes. For SHA-256
(digest size=32) this overflows client digest by 63 bytes; for MD5
(digest size=16) the overflow is 79 bytes.
The length check at line 344 fires after the write has already happened.
The HEX branch in the same switch statement already validates the length
up front. Apply the same approach to the BASE64 branch: strip trailing
base64 padding characters, then reject any input whose data length
exceeds DIV ROUND UP(digest size * 4, 3) before calling the decoder.
Stripping trailing '=' before the comparison handles both padded and
unpadded encodings. chap base64 decode() already returns early on '=',
so the full original string is still passed to the decoder unchanged.
The mutual CHAP path decodes CHAP C into initiatorchg binhex, which is
kzalloc(CHAP CHALLENGE STR LEN). extract param() caps initiatorchg at
CHAP CHALLENGE STR LEN characters, so at most CHAP CHALLENGE STR LEN-1
base64 characters reach the decoder. The maximum decoded size,
DIV ROUND UP((CHAP CHALLENGE STR LEN-1) * 3, 4), is less than
CHAP CHALLENGE STR LEN, so no overflow is possible there. A comment is
added at the call site to document this.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux