In drivers/pci/hotplug/rpadlpar_sysfs.c in the Linux kernel through 5.11.8, the RPA PCI Hotplug driver has a user-tolerable buffer overflow when writing a new device name to the driver from userspace, allowing userspace to write data to the kernel stack frame directly. This occurs because add_slot_store and remove_slot_store mishandle drc_name ‘\0’ termination, aka CID-cc7a0bb058b8.
CPE | Name | Operator | Version |
---|---|---|---|
fedora | eq | 32 | |
fedora | eq | 33 | |
fedora | eq | 34 | |
linux_kernel | ge | 5.11 | |
linux_kernel | lt | 5.11.9 | |
linux_kernel | gt | 4.15 | |
linux_kernel | le | 4.19.183 | |
linux_kernel | gt | 4.5 | |
linux_kernel | le | 4.9.263 | |
linux_kernel | ge | 5.5.0 |
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc7a0bb058b85ea03db87169c60c7cfdd5d34678
lists.fedoraproject.org/archives/list/[email protected]/message/4VCKIOXCOZGXBEZMO5LGGV5MWCHO6FT3/
lists.fedoraproject.org/archives/list/[email protected]/message/PTRNPQTZ4GVS46SZ4OBXY5YDOGVPSTGQ/
lists.fedoraproject.org/archives/list/[email protected]/message/T2S3I4SLRNRUQDOFYUS6IUAZMQNMPNLG/
security.netapp.com/advisory/ntap-20210430-0003/