In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
The following warning was observed running syzkaller:
[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9
This issue can be reproduced with the following syzkaller log:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126)
In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer().
To solve this issue, define alloc_len as u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftoolUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool-debuginfoUpgrade kernel-toolsUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.10.82-83.359Upgrade python-perfUpgrade kernel-headersUpgrade kernel-debuginfoUpgrade python-perf-debuginfoUpgrade perfUpgrade kernel-tools-develUpgrade perf-debuginfo | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade dtb-allwinnerUpgrade dtb-broadcomUpgrade kernel-rt_debug-develUpgrade kernel-docs-htmlUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-vdsoUpgrade kernel-docsUpgrade kernel-source-rtUpgrade kernel-default-livepatch-develUpgrade kernel-rt-extraUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-defaultUpgrade kernel-azure-baseUpgrade dtb-sprdUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade dtb-marvellUpgrade ocfs2-kmp-defaultUpgrade kselftests-kmp-azureUpgrade dlm-kmp-defaultUpgrade kernel-azureUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade kernel-azure-optionalUpgrade kernel-source-vanillaUpgrade dtb-nvidiaUpgrade dtb-rockchipUpgrade kernel-default-base-rebuildUpgrade kernel-64kb-extraUpgrade kernel-default-baseUpgrade kernel-azure-develUpgrade ocfs2-kmp-64kbUpgrade kernel-default-manUpgrade reiserfs-kmp-64kbUpgrade kernel-defaultUpgrade kernel-rt_debugUpgrade kernel-rtUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-debug-vdsoUpgrade kernel-rt-optionalUpgrade dtb-caviumUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-vdsoUpgrade cluster-md-kmp-defaultUpgrade kernel-default-vdsoUpgrade dlm-kmp-azureUpgrade dtb-exynosUpgrade kernel-source-azureUpgrade kernel-64kbUpgrade kernel-rt-livepatch-develUpgrade dtb-amazonUpgrade kernel-debugUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade dtb-renesasUpgrade kernel-default-develUpgrade dtb-mediatekUpgrade kernel-rt_debug-vdsoUpgrade kernel-azure-vdsoUpgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade kernel-develUpgrade kernel-sourceUpgrade dtb-hisiliconUpgrade dtb-apmUpgrade gfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-debug-develUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade kernel-default-optionalUpgrade kernel-64kb-livepatch-develUpgrade dtb-freescaleUpgrade dtb-amdUpgrade kselftests-kmp-64kbUpgrade kernel-rt-develUpgrade kernel-syms-azureUpgrade kernel-macrosUpgrade kernel-kvmsmall-develUpgrade dtb-appleUpgrade kernel-default-extraUpgrade kernel-debug-livepatch-develUpgrade dtb-amlogicUpgrade dtb-armUpgrade reiserfs-kmp-defaultUpgrade cluster-md-kmp-azureUpgrade dtb-lgUpgrade kernel-rt-livepatchUpgrade kernel-64kb-develUpgrade kernel-devel-rtUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-azureUpgrade kernel-obs-qaUpgrade kernel-devel-azureUpgrade kernel-zfcpdumpUpgrade cluster-md-kmp-rtUpgrade kernel-symsUpgrade kernel-azure-extraUpgrade kernel-kvmsmallUpgrade dlm-kmp-64kb | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-5.4.0-1151-azureUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-azure-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-1120-fipsUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-1051-iotUpgrade linux-image-gkeUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-gcp-lts-20.04Upgrade linux-image-bluefieldUpgrade linux-image-awsUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-generic-hwe-18.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-5.4.0-216-generic-lpaeUpgrade linux-image-5.4.0-216-genericUpgrade linux-image-5.4.0-1064-xilinx-zynqmpUpgrade linux-image-5.4.0-1105-bluefieldUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-4.15.0-1180-awsUpgrade linux-image-5.4.0-216-lowlatencyUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-1133-kvmUpgrade linux-image-5.4.0-1151-azure-fipsUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-virtualUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-aws-fipsUpgrade linux-image-kvmUpgrade linux-image-aws-lts-18.04Upgrade linux-image-oracleUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.15.0-1188-azureUpgrade linux-image-5.4.0-1149-gcpUpgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-generic-lpaeUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-generic-lts-xenialUpgrade linux-image-aws-hweUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-gcpUpgrade linux-image-5.4.0-1146-aws-fipsUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-4.4.0-268-genericUpgrade linux-image-aws-lts-20.04Upgrade linux-image-azureUpgrade linux-image-genericUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-raspiUpgrade linux-image-azure-lts-20.04Upgrade linux-image-gcp-fipsUpgrade linux-image-ibmUpgrade linux-image-5.4.0-1149-gcp-fipsUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-4.15.0-237-genericUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-5.4.0-1144-oracleUpgrade linux-image-azure-lts-18.04Upgrade linux-image-raspi2Upgrade linux-image-5.4.0-1092-ibmUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1146-awsUpgrade linux-image-fipsUpgrade linux-image-oem | May 8, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub