Received-SPF: pass (google.com: domain of linux-kernel+bounces-191544-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
From: Gabriel Krisman Bertazi <krisman@suse.de>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: linux-cve-announce@vger.kernel.org,  <cve@kernel.org>,
  <linux-kernel@vger.kernel.org>, keescook@chromium.org
Subject: Re: CVE-2023-52685: pstore: ram_core: fix possible overflow in
 persistent_ram_init_ecc()
In-Reply-To: <2024051752-CVE-2023-52685-64c5@gregkh> (Greg Kroah-Hartman's
	message of "Fri, 17 May 2024 16:26:58 +0200")
References: <2024051752-CVE-2023-52685-64c5@gregkh>
Date: Mon, 27 May 2024 20:32:54 -0400
Message-ID: <87jzjeojwp.fsf@mailhost.krisman.be>
User-Agent: Gnus/5.13 (Gnus v5.13)
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain

Greg Kroah-Hartman <gregkh@linuxfoundation.org> writes:

> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
>
> In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return
> 64-bit value since persistent_ram_zone::buffer_size has type size_t which
> is derived from the 64-bit *unsigned long*, while the ecc_blocks variable
> this value gets assigned to has (always 32-bit) *int* type.  Even if that
> value fits into *int* type, an overflow is still possible when calculating
> the size_t typed ecc_total variable further below since there's no cast to
> any 64-bit type before multiplication.  Declaring the ecc_blocks variable
> as *size_t* should fix this mess...
>
> Found by Linux Verification Center (linuxtesting.org) with the SVACE static
> analysis tool.

Hi Greg,

[Cc'ing Kees, who is listed as the pstore maintainer]

I want to dispute this CVE.  The overflow is in the module
initialization path, and can only happen at boot time or if the module
is loaded with specific parameters or due to specific acpi/device tree
data.  Either way, it would require root privileges to trigger.

-- 
Gabriel Krisman Bertazi