Описание
In the Linux kernel, the following vulnerability has been resolved:
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
When the MDT loader is used in remoteproc, the ELF header is sanitized
beforehand, but that's not necessary the case for other clients.
Validate the size of the firmware buffer to ensure that we don't read
past the end as we iterate over the header. e_phentsize and e_shentsize
are validated as well, to ensure that the assumptions about step size in
the traversal are valid.
A flaw was found in the Linux kernel's soc: qcom: mdt_loader component. This vulnerability allows a local attacker to cause a Denial of Service (DoS) by providing a specially crafted firmware buffer. The flaw occurs because the MDT loader does not sufficiently validate the size of the ELF header and its section entry sizes (e_phentsize and e_shentsize), leading to a read past the end of the buffer.
Отчет
A moderate-severity flaw was found in the Linux kernel's Qualcomm MDT firmware loader (soc: qcom: mdt_loader). The MDT loader did not validate the size of the firmware buffer, nor the e_phentsize and e_shentsize ELF header fields, before iterating over the ELF header, so processing a specially crafted firmware buffer could cause the kernel to read past the end of that buffer. A local attacker able to supply a crafted Qualcomm MDT firmware image and trigger its loading could use this flaw to cause a denial of service, such as a kernel crash. When the MDT loader is used via remoteproc the ELF header is sanitized beforehand, but that is not necessarily the case for other clients of the loader. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS 1 are affected; the fix for these streams is currently deferred, and the residual risk is that a local attacker with the high privileges needed to load a crafted firmware image could crash the system (denial of service only). Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected because the vulnerable code is not present in those releases. Red Hat rates this flaw Moderate (CVSS 6.0), lower than the CVE.org rating of Important (7.8), primarily because Red Hat assesses that exploitation requires high privileges and that the practical impact is limited to availability.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | kernel | Fix deferred | ||
| Red Hat Enterprise Linux 6 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel | Not affected | ||
| Red Hat Enterprise Linux 7 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel | Not affected | ||
| Red Hat Enterprise Linux 8 | kernel-rt | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel | Not affected | ||
| Red Hat Enterprise Linux 9 | kernel-rt | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
6 Medium
CVSS3
Связанные уязвимости
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.
soc: qcom: mdt_loader: Ensure we don't read past the ELF header
In the Linux kernel, the following vulnerability has been resolved: s ...
In the Linux kernel, the following vulnerability has been resolved: soc: qcom: mdt_loader: Ensure we don't read past the ELF header When the MDT loader is used in remoteproc, the ELF header is sanitized beforehand, but that's not necessary the case for other clients. Validate the size of the firmware buffer to ensure that we don't read past the end as we iterate over the header. e_phentsize and e_shentsize are validated as well, to ensure that the assumptions about step size in the traversal are valid.
EPSS
6 Medium
CVSS3