PT-2024-14673 · Linux+2 · Linux Kernel+2
Published
2023-12-14
·
Updated
2024-10-15
·
CVE-2023-52636
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability has been resolved in the Linux kernel related to the libceph component. The issue occurs when a short read happens while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all read partial *() handlers, including read partial sparse msg data(). However, read partial sparse msg data() violates the expectation and ends up calling into the state machine in the OSD client. The sparse-read state machine assumes it's a new operation and interprets some piece of the footer as the sparse-read header, returning bogus extents/data length. To determine whether read partial sparse msg data() should bail, the cursor->total resid is reused.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Red Os
Suse