CVE - CVE-2024-57890

CVE-ID
CVE-2024-57890	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap. The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things. First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use size_mul() for the multiplications.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/346db03e9926ab7117ed9bf19665699c037c773c URL:https://git.kernel.org/stable/c/346db03e9926ab7117ed9bf19665699c037c773c MISC:https://git.kernel.org/stable/c/42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608 URL:https://git.kernel.org/stable/c/42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608 MISC:https://git.kernel.org/stable/c/b3ef4ae713360501182695dd47d6b4f6e1a43eb8 URL:https://git.kernel.org/stable/c/b3ef4ae713360501182695dd47d6b4f6e1a43eb8 MISC:https://git.kernel.org/stable/c/b92667f755749cf10d9ef1088865c555ae83ffb7 URL:https://git.kernel.org/stable/c/b92667f755749cf10d9ef1088865c555ae83ffb7 MISC:https://git.kernel.org/stable/c/c2f961c46ea0e5274c5c320d007c2dd949cf627a URL:https://git.kernel.org/stable/c/c2f961c46ea0e5274c5c320d007c2dd949cf627a MISC:https://git.kernel.org/stable/c/c57721b24bd897338a81a0ca5fff41600f0f1ad1 URL:https://git.kernel.org/stable/c/c57721b24bd897338a81a0ca5fff41600f0f1ad1 MISC:https://git.kernel.org/stable/c/d0257e089d1bbd35c69b6c97ff73e3690ab149a9 URL:https://git.kernel.org/stable/c/d0257e089d1bbd35c69b6c97ff73e3690ab149a9
Assigning CNA
kernel.org
Date Record Created
20250111	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20250111)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)