CVE-2023-52618: block/rnbd-srv: Check for unlikely string overflow
In the Linux kernel, the following vulnerability has been resolved:
block/rnbd-srv: Check for unlikely string overflow
Since "devsearchpath" can technically be as large as PATHMAX, there was a risk of truncation when copying it and a second string into "fullpath" since it was also PATHMAX sized. The W=1 builds were reporting this warning:
drivers/block/rnbd/rnbd-srv.c: In function 'processmsgopen.isra': drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(fullpath, PATHMAX, "%s/%s", | ^~ In function 'rnbdsrvgetfullpath', inlined from 'processmsgopen.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(fullpath, PATHMAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | devsearchpath, devname); | ~~~~~~~~~~~~~~~~~~~~~~~~~~
To fix this, unconditionally check for truncation (as was already done for the case where "%SESSNAME%" was present).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52618?
The severity of CVE-2023-52618 is classified as medium due to the potential risk of string overflow leading to resource leaks.
How do I fix CVE-2023-52618?
To fix CVE-2023-52618, update the Linux package to one of the patched versions: 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
What versions of the Linux kernel are affected by CVE-2023-52618?
CVE-2023-52618 affects multiple versions of the Linux kernel prior to the patched releases mentioned.
Is CVE-2023-52618 a local or remote vulnerability?
CVE-2023-52618 is considered a local vulnerability, requiring local access to exploit.
What components of the Linux kernel are impacted by CVE-2023-52618?
CVE-2023-52618 impacts the block/rnbd-srv component within the Linux kernel.