In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
The following warning was observed running syzkaller:
[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9
This issue can be reproduced with the following syzkaller log:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126)
In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer().
To solve this issue, define alloc_len as u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade python-perf-debuginfoUpgrade python-perfUpgrade kernel-debuginfoUpgrade kernel-headersUpgrade kernel-livepatch-5.10.82-83.359Upgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-develUpgrade kernel-toolsUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade bpftool | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade kernel-rt_debug-livepatch-develUpgrade kernel-default-base-rebuildUpgrade kernel-rtUpgrade dtb-alteraUpgrade dtb-qcomUpgrade gfs2-kmp-azureUpgrade kernel-azureUpgrade kernel-docs-htmlUpgrade ocfs2-kmp-64kbUpgrade kernel-azure-optionalUpgrade reiserfs-kmp-64kbUpgrade dlm-kmp-rtUpgrade reiserfs-kmp-rtUpgrade kernel-source-vanillaUpgrade kernel-rt-extraUpgrade kernel-defaultUpgrade kernel-debug-vdsoUpgrade kernel-obs-buildUpgrade cluster-md-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-docsUpgrade kernel-default-manUpgrade kernel-rt_debugUpgrade kernel-rt_debug-develUpgrade kernel-rt-vdsoUpgrade dtb-sprdUpgrade kernel-default-livepatch-develUpgrade dtb-nvidiaUpgrade dtb-rockchipUpgrade gfs2-kmp-defaultUpgrade kernel-azure-baseUpgrade kernel-rt-optionalUpgrade kselftests-kmp-azureUpgrade kernel-default-baseUpgrade kernel-source-rtUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dtb-marvellUpgrade kernel-azure-develUpgrade kernel-64kb-extraUpgrade dtb-caviumUpgrade reiserfs-kmp-azureUpgrade dtb-broadcomUpgrade kernel-default-livepatchUpgrade kernel-kvmsmall-vdsoUpgrade gfs2-kmp-64kbUpgrade dtb-amdUpgrade kernel-syms-azureUpgrade kselftests-kmp-defaultUpgrade kernel-debug-develUpgrade gfs2-kmp-rtUpgrade dtb-xilinxUpgrade dtb-socionextUpgrade dtb-freescaleUpgrade kernel-debugUpgrade kernel-kvmsmall-livepatch-develUpgrade ocfs2-kmp-rtUpgrade kernel-default-vdsoUpgrade kernel-kvmsmall-develUpgrade reiserfs-kmp-defaultUpgrade dtb-amazonUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-64kbUpgrade dtb-amlogicUpgrade kernel-64kb-develUpgrade dtb-hisiliconUpgrade kernel-sourceUpgrade dtb-mediatekUpgrade kernel-zfcpdumpUpgrade kernel-azure-livepatch-develUpgrade kernel-syms-rtUpgrade kernel-devel-azureUpgrade kernel-64kb-livepatch-develUpgrade kernel-macrosUpgrade kernel-default-optionalUpgrade dtb-armUpgrade kernel-default-extraUpgrade dtb-exynosUpgrade dtb-appleUpgrade dlm-kmp-azureUpgrade kernel-azure-vdsoUpgrade kernel-64kbUpgrade kernel-symsUpgrade kernel-develUpgrade kernel-obs-qaUpgrade kernel-azure-extraUpgrade kernel-rt-livepatch-develUpgrade cluster-md-kmp-azureUpgrade dtb-renesasUpgrade kernel-kvmsmallUpgrade kernel-source-azureUpgrade dtb-lgUpgrade kernel-rt-livepatchUpgrade cluster-md-kmp-defaultUpgrade dlm-kmp-64kbUpgrade kernel-64kb-optionalUpgrade kernel-default-develUpgrade ocfs2-kmp-azureUpgrade kernel-devel-rtUpgrade cluster-md-kmp-rtUpgrade kernel-rt_debug-vdsoUpgrade dtb-apmUpgrade kernel-rt-devel | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-aws-lts-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-kvmUpgrade linux-image-aws-fipsUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-5.4.0-216-lowlatencyUpgrade linux-image-azure-fipsUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-virtualUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-5.4.0-1151-azure-fipsUpgrade linux-image-oracleUpgrade linux-image-virtual-hwe-18.04Upgrade linux-image-4.15.0-1180-awsUpgrade linux-image-5.4.0-216-genericUpgrade linux-image-gkeUpgrade linux-image-oracle-lts-18.04Upgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-5.4.0-1051-iotUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-5.4.0-1064-xilinx-zynqmpUpgrade linux-image-4.4.0-268-lowlatencyUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-5.4.0-1133-kvmUpgrade linux-image-5.4.0-1120-fipsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-5.4.0-216-generic-lpaeUpgrade linux-image-4.4.0-1143-awsUpgrade linux-image-5.4.0-1151-azureUpgrade linux-image-5.4.0-1105-bluefieldUpgrade linux-image-bluefieldUpgrade linux-image-awsUpgrade linux-image-oem-osp1Upgrade linux-image-azureUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-5.4.0-1146-awsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-genericUpgrade linux-image-lowlatencyUpgrade linux-image-gcp-fipsUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-5.4.0-1144-oracleUpgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-ibmUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1146-aws-fipsUpgrade linux-image-raspi2Upgrade linux-image-5.4.0-1149-gcpUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-generic-lpaeUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-oemUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-fipsUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-5.4.0-1092-ibmUpgrade linux-image-azure-lts-18.04Upgrade linux-image-azure-lts-20.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-aws-hweUpgrade linux-image-4.4.0-268-genericUpgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-gcpUpgrade linux-image-generic-lts-xenialUpgrade linux-image-raspiUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-5.4.0-1149-gcp-fips | May 8, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub