In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
The following warning was observed running syzkaller:
[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9
This issue can be reproduced with the following syzkaller log:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126)
In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer().
To solve this issue, define alloc_len as u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-livepatch-5.10.82-83.359Upgrade perf-debuginfoUpgrade kernel-headersUpgrade python-perfUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade kernel-debuginfo | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-sourceUpgrade kernel-syms-rtUpgrade dtb-hisiliconUpgrade dtb-lgUpgrade kernel-kvmsmallUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-rt_debug-vdsoUpgrade ocfs2-kmp-rtUpgrade kernel-debugUpgrade kernel-64kb-develUpgrade kernel-develUpgrade cluster-md-kmp-defaultUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade kselftests-kmp-64kbUpgrade dlm-kmp-azureUpgrade kernel-syms-azureUpgrade dtb-armUpgrade dtb-appleUpgrade kernel-default-extraUpgrade kernel-macrosUpgrade kernel-kvmsmall-livepatch-develUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade kernel-zfcpdumpUpgrade dtb-freescaleUpgrade dtb-socionextUpgrade dtb-amazonUpgrade dtb-xilinxUpgrade dtb-exynosUpgrade kernel-symsUpgrade gfs2-kmp-64kbUpgrade gfs2-kmp-rtUpgrade dtb-mediatekUpgrade kernel-devel-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-default-optionalUpgrade kernel-64kb-livepatch-develUpgrade kernel-azure-vdsoUpgrade kernel-rt-livepatch-develUpgrade kernel-devel-rtUpgrade dtb-apmUpgrade dtb-amdUpgrade kernel-rt-develUpgrade dtb-renesasUpgrade kernel-debug-develUpgrade kernel-default-develUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade kernel-64kb-optionalUpgrade dlm-kmp-64kbUpgrade kernel-64kbUpgrade kernel-obs-qaUpgrade kernel-azure-extraUpgrade dtb-alteraUpgrade kernel-rt_debug-develUpgrade kernel-azure-baseUpgrade kernel-default-manUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade kernel-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-base-rebuildUpgrade dtb-rockchipUpgrade kernel-default-livepatchUpgrade kernel-default-baseUpgrade dtb-allwinnerUpgrade kernel-source-rtUpgrade kernel-azureUpgrade kernel-64kb-extraUpgrade reiserfs-kmp-azureUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-azureUpgrade dtb-broadcomUpgrade kernel-docs-htmlUpgrade kernel-obs-buildUpgrade kernel-source-vanillaUpgrade reiserfs-kmp-64kbUpgrade kernel-debug-vdsoUpgrade dlm-kmp-rtUpgrade dtb-qcomUpgrade dtb-caviumUpgrade dtb-sprdUpgrade kernel-rt-extraUpgrade kernel-default-livepatch-develUpgrade kselftests-kmp-rtUpgrade dtb-nvidiaUpgrade kernel-defaultUpgrade kselftests-kmp-azureUpgrade dtb-marvellUpgrade ocfs2-kmp-defaultUpgrade kernel-azure-optionalUpgrade gfs2-kmp-defaultUpgrade reiserfs-kmp-rtUpgrade kernel-rt-optionalUpgrade kernel-rt_debugUpgrade kernel-azure-develUpgrade cluster-md-kmp-64kb | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1144-oracleUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-aws-lts-20.04Upgrade linux-image-generic-lpaeUpgrade linux-image-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1146-aws-fipsUpgrade linux-image-azure-lts-20.04Upgrade linux-image-gcpUpgrade linux-image-fipsUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-azureUpgrade linux-image-4.4.0-268-genericUpgrade linux-image-azure-lts-18.04Upgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-aws-hweUpgrade linux-image-genericUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1146-awsUpgrade linux-image-raspi2Upgrade linux-image-oracle-lts-20.04Upgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-ibmUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-gcp-fipsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-oemUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-5.4.0-1092-ibmUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-5.4.0-1149-gcpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-5.4.0-1149-gcp-fipsUpgrade linux-image-5.4.0-1133-kvmUpgrade linux-image-bluefieldUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-4.15.0-1180-awsUpgrade linux-image-virtualUpgrade linux-image-5.4.0-1064-xilinx-zynqmpUpgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-aws-lts-18.04Upgrade linux-image-virtual-lts-xenialUpgrade linux-image-5.4.0-1151-azure-fipsUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-aws-fipsUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-azure-fipsUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1120-fipsUpgrade linux-image-5.4.0-216-generic-lpaeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-kvmUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-5.4.0-1151-azureUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-5.4.0-1051-iotUpgrade linux-image-gkeUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-5.4.0-1105-bluefieldUpgrade linux-image-5.4.0-216-genericUpgrade linux-image-awsUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-oracleUpgrade linux-image-5.4.0-216-lowlatency | May 8, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub