CVE-2024-38578

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ecryptfs: Fix buffer size for tag 66 packet<br /> <br /> The &amp;#39;TAG 66 Packet Format&amp;#39; description is missing the cipher code and<br /> checksum fields that are packed into the message packet. As a result,<br /> the buffer allocated for the packet is 3 bytes too small and<br /> write_tag_66_packet() will write up to 3 bytes past the end of the<br /> buffer.<br /> <br /> Fix this by increasing the size of the allocation so the whole packet<br /> will always fit in the buffer.<br /> <br /> This fixes the below kasan slab-out-of-bounds bug:<br /> <br /> BUG: KASAN: slab-out-of-bounds in ecryptfs_generate_key_packet_set+0x7d6/0xde0<br /> Write of size 1 at addr ffff88800afbb2a5 by task touch/181<br /> <br /> CPU: 0 PID: 181 Comm: touch Not tainted 6.6.13-gnu #1 4c9534092be820851bb687b82d1f92a426598dc6<br /> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2/GNU Guix 04/01/2014<br /> Call Trace:<br /> <br /> dump_stack_lvl+0x4c/0x70<br /> print_report+0xc5/0x610<br /> ? ecryptfs_generate_key_packet_set+0x7d6/0xde0<br /> ? kasan_complete_mode_report_info+0x44/0x210<br /> ? ecryptfs_generate_key_packet_set+0x7d6/0xde0<br /> kasan_report+0xc2/0x110<br /> ? ecryptfs_generate_key_packet_set+0x7d6/0xde0<br /> __asan_store1+0x62/0x80<br /> ecryptfs_generate_key_packet_set+0x7d6/0xde0<br /> ? __pfx_ecryptfs_generate_key_packet_set+0x10/0x10<br /> ? __alloc_pages+0x2e2/0x540<br /> ? __pfx_ovl_open+0x10/0x10 [overlay 30837f11141636a8e1793533a02e6e2e885dad1d]<br /> ? dentry_open+0x8f/0xd0<br /> ecryptfs_write_metadata+0x30a/0x550<br /> ? __pfx_ecryptfs_write_metadata+0x10/0x10<br /> ? ecryptfs_get_lower_file+0x6b/0x190<br /> ecryptfs_initialize_file+0x77/0x150<br /> ecryptfs_create+0x1c2/0x2f0<br /> path_openat+0x17cf/0x1ba0<br /> ? __pfx_path_openat+0x10/0x10<br /> do_filp_open+0x15e/0x290<br /> ? __pfx_do_filp_open+0x10/0x10<br /> ? __kasan_check_write+0x18/0x30<br /> ? _raw_spin_lock+0x86/0xf0<br /> ? __pfx__raw_spin_lock+0x10/0x10<br /> ? __kasan_check_write+0x18/0x30<br /> ? alloc_fd+0xf4/0x330<br /> do_sys_openat2+0x122/0x160<br /> ? __pfx_do_sys_openat2+0x10/0x10<br /> __x64_sys_openat+0xef/0x170<br /> ? __pfx___x64_sys_openat+0x10/0x10<br /> do_syscall_64+0x60/0xd0<br /> entry_SYSCALL_64_after_hwframe+0x6e/0xd8<br /> RIP: 0033:0x7f00a703fd67<br /> Code: 25 00 00 41 00 3d 00 00 41 00 74 37 64 8b 04 25 18 00 00 00 85 c0 75 5b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 3d 00 f0 ff ff 0f 87 85 00 00 00 48 83 c4 68 5d 41 5c c3 0f 1f<br /> RSP: 002b:00007ffc088e30b0 EFLAGS: 00000246 ORIG_RAX: 0000000000000101<br /> RAX: ffffffffffffffda RBX: 00007ffc088e3368 RCX: 00007f00a703fd67<br /> RDX: 0000000000000941 RSI: 00007ffc088e48d7 RDI: 00000000ffffff9c<br /> RBP: 00007ffc088e48d7 R08: 0000000000000001 R09: 0000000000000000<br /> R10: 00000000000001b6 R11: 0000000000000246 R12: 0000000000000941<br /> R13: 0000000000000000 R14: 00007ffc088e48d7 R15: 00007f00a7180040<br /> <br /> <br /> Allocated by task 181:<br /> kasan_save_stack+0x2f/0x60<br /> kasan_set_track+0x29/0x40<br /> kasan_save_alloc_info+0x25/0x40<br /> __kasan_kmalloc+0xc5/0xd0<br /> __kmalloc+0x66/0x160<br /> ecryptfs_generate_key_packet_set+0x6d2/0xde0<br /> ecryptfs_write_metadata+0x30a/0x550<br /> ecryptfs_initialize_file+0x77/0x150<br /> ecryptfs_create+0x1c2/0x2f0<br /> path_openat+0x17cf/0x1ba0<br /> do_filp_open+0x15e/0x290<br /> do_sys_openat2+0x122/0x160<br /> __x64_sys_openat+0xef/0x170<br /> do_syscall_64+0x60/0xd0<br /> entry_SYSCALL_64_after_hwframe+0x6e/0xd8