Received-SPF: pass (google.com: domain of linux-kernel+bounces-188587-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Fri, 24 May 2024 12:02:10 +0200
From: Jiri Bohac <jbohac@suse.cz>
To: cve@kernel.org, linux-kernel@vger.kernel.org
Cc: linux-cve-announce@vger.kernel.org,
	Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	Eric Biederman <ebiederm@xmission.com>, kexec@lists.infradead.org
Subject: Re: CVE-2023-52823: kernel: kexec: copy user-array safely
Message-ID: <ZlBlorsBMPK0RdnR@dwarf.suse.cz>
References: <2024052106-CVE-2023-52823-3d81@gregkh>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <2024052106-CVE-2023-52823-3d81@gregkh>

On Tue, May 21, 2024 at 05:31:59PM +0200, Greg Kroah-Hartman wrote:
> kernel: kexec: copy user-array safely
> 
> Currently, there is no overflow-check with memdup_user().

This is false. 
Therefore, I'd like to dispute this CVE.

The overflow check is in the kexec_load_check()
function called shortly before the memdup_user() call:


	SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
			struct kexec_segment __user *, segments, unsigned long, flags)
	{
		result = kexec_load_check(nr_segments, flags);
		if (result)
			return result;
	...
		ksegments = memdup_user(segments, nr_segments * sizeof(ksegments[0]));
	...
	}

	#define KEXEC_SEGMENT_MAX 16
	static inline int kexec_load_check(unsigned long nr_segments,
					   unsigned long flags)
	{
	...
		if (nr_segments > KEXEC_SEGMENT_MAX)
			return -EINVAL;
	}


Thanks,

-- 
Jiri Bohac <jbohac@suse.cz>
SUSE Labs, Prague, Czechia