ACK: [SRU][J][PATCH 0/1] CVE-2024-53187

[Andrei Gherzan]

On 26/09/07 04:51PM, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2024-53187
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> io_uring: check for overflows in io_pin_pages
> 
> WARNING: CPU: 0 PID: 5834 at io_uring/memmap.c:144 io_pin_pages+0x149/0x180
> io_uring/memmap.c:144 CPU: 0 UID: 0 PID: 5834 Comm: syz-executor825 Not tainted
> 6.12.0-next-20241118-syzkaller #0 Call Trace: <TASK> __io_uaddr_map+0xfb/0x2d0
> io_uring/memmap.c:183 io_rings_map io_uring/io_uring.c:2611 [inline]
> io_allocate_scq_urings+0x1c0/0x650 io_uring/io_uring.c:3470
> io_uring_create+0x5b5/0xc00 io_uring/io_uring.c:3692 io_uring_setup
> io_uring/io_uring.c:3781 [inline] ... </TASK>
> 
> io_pin_pages()'s uaddr parameter came directly from the user and can be
> garbage. Don't just add size to it as it can overflow.
> 
> [ Fix ]
> 
> jammy/linux: backported from 0c0a4eae26ac
> 
> The upstream fix guards the page-pinning arithmetic in io_pin_pages()
> against integer overflow, since the user-supplied address is added to the
> size without a bounds check. This tree predates the io_uring/memmap.c file
> and the io_pin_pages() helper; the equivalent page-pinning logic lives
> inline in io_sqe_buffer_register() in io_uring/io_uring.c. The backport
> therefore applies the check_add_overflow() guards to that function's
> "end = ubuf + iov_len + PAGE_SIZE - 1" computation, returning
> -EOVERFLOW through the existing error/teardown path instead of the
> ERR_PTR convention used upstream.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> A regression from this change would surface in userspace programs that use
> io_uring and register user memory as fixed buffers via IORING_REGISTER_BUFFERS,
> such as high-performance I/O daemons, databases and network servers. A bad fix
> could wrongly reject legitimate buffer registrations with -EOVERFLOW, causing
> those applications to fail to set up their io_uring rings or buffers. Workloads
> that do not use io_uring, or that use it without registering buffers, are not
> affected.
> 
> [ Other Info ]
> 
> Kybele flow-v10-17-ge6719947. Reference: f9505618/v1

Acked-by: Andrei Gherzan <andrei.gherzan at canonical.com>

-- 
Andrei Gherzan
gpg: rsa4096/D4D94F67AD0E9640
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: not available
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260910/32a572ce/attachment.sig>