REDHAT-BUG-2524458: Medium severity Linux Linux kernel vulnerability
In the Linux kernel, the following vulnerability has been resolved:
powerpc/pseries: papr-phy-attest - validate cmd.length, plug mem leak
In paprphyattestcreatehandle(), the params->cmd.length is not validated before use, which can result in a buffer overlow. Check it and return -EINVAL if it is either 0 or exceeds sizeof(params->cmd).
Also, params is freed on the success path but not error. Free it on errors after memory allocation. And free it on negative fd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In papr_phy_attest_create_handle(), validate params->cmd.length before use and return -EINVAL when it is 0 or exceeds sizeof(params->cmd); free params on error paths, including when the file descriptor is negative.
Event History
Frequently Asked Questions
What systems are exposed to this issue?
The affected code is in the Linux kernel powerpc/pseries papr-phy-attest functionality. Systems not using that kernel component are not indicated as exposed by the available information.
What input condition triggers the vulnerability?
The issue occurs when params->cmd.length is used without validation. A length of zero or a value larger than sizeof(params->cmd) is rejected by the fix with -EINVAL.
What does the fix change besides validating the command length?
It also corrects memory cleanup for error paths after allocation and when a negative file descriptor is returned, preventing the described memory leaks.