In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
The following warning was observed running syzkaller:
[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9
This issue can be reproduced with the following syzkaller log:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126)
In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer().
To solve this issue, define alloc_len as u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.82-83.359Upgrade perfUpgrade kernel-debuginfo-common-x86_64Upgrade kernelUpgrade bpftoolUpgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-develUpgrade kernel-tools-debuginfoUpgrade kernel-tools | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade gfs2-kmp-defaultUpgrade dtb-marvellUpgrade dtb-caviumUpgrade kernel-kvmsmall-vdsoUpgrade kernel-64kb-extraUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-azure-develUpgrade kernel-defaultUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade kselftests-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-azure-baseUpgrade kernel-default-baseUpgrade ocfs2-kmp-defaultUpgrade kernel-azureUpgrade kernel-obs-buildUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-defaultUpgrade dtb-broadcomUpgrade kernel-source-rtUpgrade kernel-docsUpgrade reiserfs-kmp-64kbUpgrade kernel-rt_debugUpgrade kernel-debug-vdsoUpgrade dtb-alteraUpgrade kernel-docs-htmlUpgrade kernel-rt-vdsoUpgrade kernel-source-vanillaUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade gfs2-kmp-azureUpgrade dtb-qcomUpgrade dtb-allwinnerUpgrade kernel-rt-extraUpgrade dtb-nvidiaUpgrade cluster-md-kmp-64kbUpgrade dtb-rockchipUpgrade kernel-rtUpgrade kernel-rt_debug-develUpgrade kernel-default-manUpgrade kernel-default-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-default-livepatchUpgrade dtb-xilinxUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade kernel-devel-azureUpgrade kernel-azure-vdsoUpgrade kernel-zfcpdumpUpgrade dtb-renesasUpgrade kernel-64kb-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-sourceUpgrade kernel-syms-rtUpgrade kernel-develUpgrade kernel-64kb-develUpgrade dtb-armUpgrade dtb-appleUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade kernel-kvmsmall-develUpgrade kernel-syms-azureUpgrade dtb-amdUpgrade gfs2-kmp-64kbUpgrade dtb-socionextUpgrade kselftests-kmp-64kbUpgrade dtb-apmUpgrade gfs2-kmp-rtUpgrade dtb-freescaleUpgrade kernel-debug-develUpgrade dtb-exynosUpgrade dlm-kmp-azureUpgrade kernel-default-vdsoUpgrade kernel-debugUpgrade dtb-lgUpgrade dtb-amazonUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade kernel-rt-livepatchUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-azure-extraUpgrade cluster-md-kmp-azureUpgrade kernel-source-azureUpgrade dlm-kmp-64kbUpgrade kernel-rt-develUpgrade kselftests-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-symsUpgrade kernel-64kb-optionalUpgrade kernel-default-optionalUpgrade dtb-mediatekUpgrade kernel-default-develUpgrade kernel-devel-rtUpgrade kernel-obs-qaUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-gcp-lts-18.04Upgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-kvmUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1151-azureUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-aws-fipsUpgrade linux-image-gkeUpgrade linux-image-aws-lts-18.04Upgrade linux-image-4.15.0-1180-awsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-1051-iotUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-azure-fipsUpgrade linux-image-bluefieldUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1133-kvmUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-virtualUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-awsUpgrade linux-image-5.4.0-1120-fipsUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1151-azure-fipsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-5.4.0-1105-bluefieldUpgrade linux-image-5.4.0-216-lowlatencyUpgrade linux-image-5.4.0-216-generic-lpaeUpgrade linux-image-5.4.0-1064-xilinx-zynqmpUpgrade linux-image-5.4.0-216-genericUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-azure-lts-20.04Upgrade linux-image-genericUpgrade linux-image-gcp-fipsUpgrade linux-image-ibmUpgrade linux-image-5.4.0-1144-oracleUpgrade linux-image-azure-lts-18.04Upgrade linux-image-oem-osp1Upgrade linux-image-raspi2Upgrade linux-image-azureUpgrade linux-image-5.4.0-1092-ibmUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-aws-lts-20.04Upgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-5.4.0-1149-gcp-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-4.4.0-268-genericUpgrade linux-image-gcpUpgrade linux-image-5.4.0-1149-gcpUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1146-aws-fipsUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-oemUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-aws-hweUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.4.0-1181-awsUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-raspiUpgrade linux-image-generic-lts-xenialUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-5.4.0-1146-awsUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-fips | May 8, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub