CVE-2026-43407

Слабость

In the Linux kernel, the following vulnerability has been resolved: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() This patch fixes an out-of-bounds access in ceph_handle_auth_reply() that can be triggered by a message of type CEPH_MSG_AUTH_REPLY. In ceph_handle_auth_reply(), the value of the payload_len field of such a message is stored in a variable of type int. A value greater than INT_MAX leads to an integer overflow and is interpreted as a negative value. This leads to decrementing the pointer address by this value and subsequently accessing it because ceph_decode_need() only checks that the memory access does not exceed the end address of the allocation. This patch fixes the issue by changing the data type of payload_len to u32. Additionally, the data type of result_msg_len is changed to u32, as it is also a variable holding a non-negative length. Also, an additional layer of sanity checks is introduced, ensuring that directly after reading it from the message, payload_len and result_msg_len are not greater than the overall segment length. BUG: KASAN: slab-out-of-bounds in ceph_handle_auth_reply+0x642/0x7a0 [libceph] Read of size 4 at addr ffff8881140

Затронутые продукты

• linux linux_kernel

Источники

• https://git.kernel.org/stable/c/6cee34d6669fe176b4259131adb1a145c939b472
• https://git.kernel.org/stable/c/8bb87547e92dcf0928ed763c60e0ac8d733c3656
• https://git.kernel.org/stable/c/9f9e2297f45fc2d2524eb104c289d69ddef95665
• https://git.kernel.org/stable/c/b282c43ed156ae15ea76748fc15cd5c39dc9ab72
• https://git.kernel.org/stable/c/ea080b21092590122c3f971cf588932cdbf47847
• https://git.kernel.org/stable/c/ed024d2f4c79c0eb2464df0fb640610ac301f9a0