In the Linux kernel, the following vulnerability has been resolved:
scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
The following warning was observed running syzkaller:
[ 3813.830724] sg_write: data in/out 65466/242 bytes for SCSI command 0x9e-- guessing data in; [ 3813.830724] program syz-executor not setting count and/or reply_len properly [ 3813.836956] ================================================================== [ 3813.839465] BUG: KASAN: stack-out-of-bounds in sg_copy_buffer+0x157/0x1e0 [ 3813.841773] Read of size 4096 at addr ffff8883cf80f540 by task syz-executor/1549 [ 3813.846612] Call Trace: [ 3813.846995] dump_stack+0x108/0x15f [ 3813.847524] print_address_description+0xa5/0x372 [ 3813.848243] kasan_report.cold+0x236/0x2a8 [ 3813.849439] check_memory_region+0x240/0x270 [ 3813.850094] memcpy+0x30/0x80 [ 3813.850553] sg_copy_buffer+0x157/0x1e0 [ 3813.853032] sg_copy_from_buffer+0x13/0x20 [ 3813.853660] fill_from_dev_buffer+0x135/0x370 [ 3813.854329] resp_readcap16+0x1ac/0x280 [ 3813.856917] schedule_resp+0x41f/0x1630 [ 3813.858203] scsi_debug_queuecommand+0xb32/0x17e0 [ 3813.862699] scsi_dispatch_cmd+0x330/0x950 [ 3813.863329] scsi_request_fn+0xd8e/0x1710 [ 3813.863946] __blk_run_queue+0x10b/0x230 [ 3813.864544] blk_execute_rq_nowait+0x1d8/0x400 [ 3813.865220] sg_common_write.isra.0+0xe61/0x2420 [ 3813.871637] sg_write+0x6c8/0xef0 [ 3813.878853] __vfs_write+0xe4/0x800 [ 3813.883487] vfs_write+0x17b/0x530 [ 3813.884008] ksys_write+0x103/0x270 [ 3813.886268] __x64_sys_write+0x77/0xc0 [ 3813.886841] do_syscall_64+0x106/0x360 [ 3813.887415] entry_SYSCALL_64_after_hwframe+0x44/0xa9
This issue can be reproduced with the following syzkaller log:
r0 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x26e1, 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fd/3\x00') open_by_handle_at(r1, &(0x7f00000003c0)=ANY=[@ANYRESHEX], 0x602000) r2 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x40782) write$binfmt_aout(r2, &(0x7f0000000340)=ANY=[@ANYBLOB="00000000deff000000000000000000000000000000000000000000000000000047f007af9e107a41ec395f1bded7be24277a1501ff6196a83366f4e6362bc0ff2b247f68a972989b094b2da4fb3607fcf611a22dd04310d28c75039d"], 0x126)
In resp_readcap16() we get "int alloc_len" value -1104926854, and then pass the huge arr_len to fill_from_dev_buffer(), but arr is only 32 bytes. This leads to OOB in sg_copy_buffer().
To solve this issue, define alloc_len as u32.
CVSS Details
- CVSS 3.1 Base Score: 7.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade kernel-tools-develUpgrade python-perfUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.10.82-83.359Upgrade kernel-headersUpgrade kernel-debuginfoUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-develUpgrade bpftool-debuginfoUpgrade bpftoolUpgrade kernel-tools | Aug 28, 2024 | Apr 10, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 10, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 10, 2024 |
| Suse | — | Upgrade dtb-mediatekUpgrade kernel-azure-vdsoUpgrade kernel-macrosUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade kernel-devel-azureUpgrade dtb-armUpgrade kernel-zfcpdumpUpgrade kernel-kvmsmall-develUpgrade kernel-azure-livepatch-develUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-source-azureUpgrade kernel-rt-livepatchUpgrade kernel-default-optionalUpgrade kernel-kvmsmallUpgrade kernel-rt_debug-vdsoUpgrade reiserfs-kmp-defaultUpgrade kernel-azure-extraUpgrade dtb-appleUpgrade dtb-freescaleUpgrade dtb-socionextUpgrade dtb-xilinxUpgrade dtb-renesasUpgrade kernel-rt-develUpgrade dtb-apmUpgrade kernel-devel-rtUpgrade kernel-obs-qaUpgrade gfs2-kmp-rtUpgrade kernel-syms-rtUpgrade dtb-lgUpgrade kernel-default-vdsoUpgrade dlm-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade dtb-amazonUpgrade dtb-amdUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade gfs2-kmp-64kbUpgrade ocfs2-kmp-azureUpgrade kernel-64kb-optionalUpgrade kernel-debugUpgrade kernel-default-extraUpgrade kernel-default-develUpgrade dtb-exynosUpgrade ocfs2-kmp-rtUpgrade kernel-symsUpgrade dlm-kmp-azureUpgrade dtb-amlogicUpgrade kernel-64kb-develUpgrade dtb-hisiliconUpgrade kernel-syms-azureUpgrade kernel-develUpgrade kernel-debug-livepatch-develUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade kselftests-kmp-azureUpgrade kernel-docsUpgrade reiserfs-kmp-64kbUpgrade kernel-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-default-base-rebuildUpgrade gfs2-kmp-defaultUpgrade kernel-azure-baseUpgrade kernel-default-livepatchUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-livepatch-develUpgrade dtb-nvidiaUpgrade reiserfs-kmp-rtUpgrade dtb-rockchipUpgrade dlm-kmp-rtUpgrade kernel-azure-optionalUpgrade kselftests-kmp-rtUpgrade dtb-marvellUpgrade ocfs2-kmp-defaultUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-azureUpgrade dtb-alteraUpgrade dtb-sprdUpgrade dtb-qcomUpgrade kernel-obs-buildUpgrade dtb-broadcomUpgrade kernel-azureUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade dlm-kmp-defaultUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-default-baseUpgrade kernel-azure-develUpgrade kernel-64kb-extraUpgrade dtb-caviumUpgrade kernel-default-livepatch-develUpgrade kernel-defaultUpgrade kernel-rt-extraUpgrade kernel-rt-vdsoUpgrade dtb-allwinnerUpgrade cluster-md-kmp-64kbUpgrade kernel-default-manUpgrade kernel-rt_debugUpgrade kernel-rt_debug-devel | Aug 9, 2024 | Apr 10, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-lpaeUpgrade linux-image-4.15.0-2081-gcp-fipsUpgrade linux-image-lowlatencyUpgrade linux-image-4.15.0-2097-azure-fipsUpgrade linux-image-raspi2Upgrade linux-image-azure-lts-18.04Upgrade linux-image-azureUpgrade linux-image-5.4.0-1146-awsUpgrade linux-image-4.4.0-1181-awsUpgrade linux-image-5.4.0-1146-aws-fipsUpgrade linux-image-gcp-fipsUpgrade linux-image-virtual-hwe-16.04Upgrade linux-image-ibmUpgrade linux-image-4.15.0-2118-aws-fipsUpgrade linux-image-fipsUpgrade linux-image-4.15.0-1188-azureUpgrade linux-image-azure-lts-20.04Upgrade linux-image-aws-lts-20.04Upgrade linux-image-4.15.0-237-lowlatencyUpgrade linux-image-4.4.0-268-genericUpgrade linux-image-aws-hweUpgrade linux-image-oemUpgrade linux-image-4.15.0-237-genericUpgrade linux-image-snapdragon-hwe-18.04Upgrade linux-image-5.4.0-1144-oracleUpgrade linux-image-4.4.0-1113-fipsUpgrade linux-image-gcpUpgrade linux-image-4.15.0-1173-gcpUpgrade linux-image-4.4.0-1144-kvmUpgrade linux-image-oem-osp1Upgrade linux-image-5.4.0-1149-gcp-fipsUpgrade linux-image-raspiUpgrade linux-image-ibm-lts-20.04Upgrade linux-image-generic-lts-xenialUpgrade linux-image-5.4.0-1129-raspiUpgrade linux-image-5.4.0-1092-ibmUpgrade linux-image-genericUpgrade linux-image-5.4.0-1149-gcpUpgrade linux-image-oracle-lts-20.04Upgrade linux-image-4.4.0-1143-awsUpgrade linux-image-oracleUpgrade linux-image-5.4.0-1051-iotUpgrade linux-image-raspi-hwe-18.04Upgrade linux-image-5.4.0-216-generic-lpaeUpgrade linux-image-5.4.0-1120-fipsUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-4.15.0-1142-oracleUpgrade linux-image-gcp-lts-18.04Upgrade linux-image-lowlatency-hwe-16.04Upgrade linux-image-gcp-lts-20.04Upgrade linux-image-oracle-lts-18.04Upgrade linux-image-virtual-hwe-18.04Upgrade linux-image-5.4.0-216-lowlatencyUpgrade linux-image-5.4.0-1151-azureUpgrade linux-image-5.4.0-1064-xilinx-zynqmpUpgrade linux-image-generic-hwe-18.04Upgrade linux-image-5.4.0-1105-bluefieldUpgrade linux-image-4.15.0-1163-kvmUpgrade linux-image-5.4.0-216-genericUpgrade linux-image-4.15.0-1180-awsUpgrade linux-image-azure-fipsUpgrade linux-image-virtual-lts-xenialUpgrade linux-image-aws-lts-18.04Upgrade linux-image-5.4.0-1151-azure-fipsUpgrade linux-image-aws-fipsUpgrade linux-image-lowlatency-lts-xenialUpgrade linux-image-kvmUpgrade linux-image-5.4.0-1133-kvmUpgrade linux-image-generic-hwe-16.04Upgrade linux-image-awsUpgrade linux-image-bluefieldUpgrade linux-image-4.15.0-1135-fipsUpgrade linux-image-lowlatency-hwe-18.04Upgrade linux-image-gkeUpgrade linux-image-virtualUpgrade linux-image-4.4.0-268-lowlatency | May 8, 2025 | Apr 10, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Apr 10, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub