CVE-2015-4036: Buffer Overflow
Array index error in the tcmvhostmaketpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOSTSCSISETENDPOINT ioctl call. NOTE: the affected function was renamed to vhostscsimaketpg before the vulnerability was announced.
Other sources
It was reported that in vhostscsimaketpg() the limit for "tpgt" is UINTMAX but the data type of "tpg->tporttpgt" and that is a u16.
In the context it turns out that in vhostscsisetendpoint(), "tpg->tporttpgt" is used as an offset into the vstpg[] array which has VHOSTSCSIMAXTARGET (256) elements, so anything higher than 255 then is invalid. Attached patch corrects this. In vhostscsisendevt() the values higher than 255 are masked, but now that the limit has changed, the mask is not needed.
Upstream fix: http://www.spinics.net/lists/linux-scsi/msg82650.html
Discussion: http://www.openwall.com/lists/oss-security/2015/05/13/4
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4036?
CVE-2015-4036 has a high severity rating due to its potential to cause denial of service and memory corruption.
How do I fix CVE-2015-4036?
To fix CVE-2015-4036, upgrade your Linux kernel to version 4.0 or higher.
Which versions of the Linux kernel are affected by CVE-2015-4036?
CVE-2015-4036 affects Linux kernel versions prior to 4.0, including several specific versions between 3.6 and 3.19.
What impact does CVE-2015-4036 have on systems?
CVE-2015-4036 could allow attackers to cause memory corruption and potentially disrupt system services.
Is CVE-2015-4036 a common vulnerability in Linux systems?
Yes, CVE-2015-4036 is considered a significant vulnerability due to its impact on widely used Linux kernel versions.