CVE-2023-52733

{"id": "CVE-2023-52733", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2024-05-21T16:15:13.380", "references": [{"url": "https://git.kernel.org/stable/c/16409f7d9ca5bb8220e1049ea9aae0d3c94d2dfb", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/55dbd6f4ea954751340f4f73d5dcd7c8f12208b2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/7ab41c2c08a32132ba8c14624910e2fe8ce4ba4b", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/9ed522143f959630f8b7782ddc212900d8f609a9", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f1eb22d0ff064ad458b3b1a1eaa84ac3996206c2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-120"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ns390/decompressor: specify __decompress() buf len to avoid overflow\n\nHistorically calls to __decompress() didn't specify \"out_len\" parameter\non many architectures including s390, expecting that no writes beyond\nuncompressed kernel image are performed. This has changed since commit\n2aa14b1ab2c4 (\"zstd: import usptream v1.5.2\") which includes zstd library\ncommit 6a7ede3dfccb (\"Reduce size of dctx by reutilizing dst buffer\n(#2751)\"). Now zstd decompression code might store literal buffer in\nthe unwritten portion of the destination buffer. Since \"out_len\" is\nnot set, it is considered to be unlimited and hence free to use for\noptimization needs. On s390 this might corrupt initrd or ipl report\nwhich are often placed right after the decompressor buffer. Luckily the\nsize of uncompressed kernel image is already known to the decompressor,\nso to avoid the problem simply specify it in the \"out_len\" parameter."}, {"lang": "es", "value": "En el kernel de Linux, se resolvi\u00f3 la siguiente vulnerabilidad: s390/decompressor: especifique __decompress() buf len para evitar el desbordamiento. Hist\u00f3ricamente, las llamadas a __decompress() no especificaban el par\u00e1metro \"out_len\" en muchas arquitecturas, incluido s390, esperando que no se escribieran m\u00e1s all\u00e1 Se realizan im\u00e1genes del kernel sin comprimir. Esto ha cambiado desde la confirmaci\u00f3n 2aa14b1ab2c4 (\"zstd: import usptream v1.5.2\") que incluye la confirmaci\u00f3n de la biblioteca zstd 6a7ede3dfccb (\"Reducir el tama\u00f1o de dctx reutilizando el b\u00fafer dst (#2751)\"). Ahora el c\u00f3digo de descompresi\u00f3n zstd podr\u00eda almacenar un b\u00fafer literal en la parte no escrita del b\u00fafer de destino. Dado que \"out_len\" no est\u00e1 configurado, se considera ilimitado y, por lo tanto, de uso gratuito para las necesidades de optimizaci\u00f3n. En s390, esto podr\u00eda da\u00f1ar el informe initrd o ipl que a menudo se coloca justo despu\u00e9s del buffer del descompresor. Afortunadamente, el descompresor ya conoce el tama\u00f1o de la imagen del kernel sin comprimir, por lo que para evitar el problema simplemente especif\u00edquelo en el par\u00e1metro \"out_len\"."}], "lastModified": "2024-07-03T01:43:52.120", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}