First published: Wed Nov 07 2007(Updated: )
Description of problem: The blkif_get_x86_32_req() and blkif_get_x86_64_req() functions don't sanity-check the req->nr_segments value. The functions are part of the 32-on-64 support. They translate block I/O request structs from 32bit ABI to 64bit ABI and visa versa. They are used in case 32bit paravirtualized guests (or 32bit hvm guests with pv-on-hvm drivers installed) are running on a 64bit host. Version-Release number of selected component (if applicable): RHEL 5.1 kernel.
Affected Software | Affected Version | How to fix |
---|---|---|
Red Hat Enterprise Linux |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The severity of REDHAT-BUG-369531 has not been explicitly stated but it involves a lack of input validation which can lead to potential exploitation.
To fix REDHAT-BUG-369531, ensure that the affected functions implement adequate sanity checks on the req->nr_segments value.
REDHAT-BUG-369531 affects various versions of Red Hat Enterprise Linux.
Yes, REDHAT-BUG-369531 could potentially lead to security vulnerabilities due to the lack of sanity checks in the I/O request handling.
The blkif_get_x86_32_req() and blkif_get_x86_64_req() functions are responsible for translating block I/O requests between 32bit and 64bit ABIs in Red Hat Enterprise Linux.