cve-2024-36920
Vulnerability from cvelistv5
Published
2024-05-30 15:29
Modified
2024-08-02 03:43
Severity
Summary
scsi: mpi3mr: Avoid memcpy field-spanning write WARNING
References
SourceURLTags
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/429846b4b6ce9853e0d803a2357bb2e55083adf0
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4d2772324f43cf5674ac3dbe3f74a7e656396716
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/5f0266044dc611563539705bff0b3e1545fbb6aa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f09318244c6cafd10aca741b9c01e0a2c362d43a
Impacted products
VendorProduct
LinuxLinux
LinuxLinux
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-36920",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-05T18:22:06.427418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-05T18:22:15.903Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:49.112Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/5f0266044dc611563539705bff0b3e1545fbb6aa"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/f09318244c6cafd10aca741b9c01e0a2c362d43a"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/4d2772324f43cf5674ac3dbe3f74a7e656396716"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://git.kernel.org/stable/c/429846b4b6ce9853e0d803a2357bb2e55083adf0"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr_app.c",
            "include/uapi/scsi/scsi_bsg_mpi3mr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5f0266044dc6",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "f09318244c6c",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "4d2772324f43",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            },
            {
              "lessThan": "429846b4b6ce",
              "status": "affected",
              "version": "1da177e4c3f4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/scsi/mpi3mr/mpi3mr_app.c",
            "include/uapi/scsi/scsi_bsg_mpi3mr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.91",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.31",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "6.8.*",
              "status": "unaffected",
              "version": "6.8.10",
              "versionType": "custom"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.9",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nscsi: mpi3mr: Avoid memcpy field-spanning write WARNING\n\nWhen the \"storcli2 show\" command is executed for eHBA-9600, mpi3mr driver\nprints this WARNING message:\n\n  memcpy: detected field-spanning write (size 128) of single field \"bsg_reply_buf-\u003ereply_buf\" at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 (size 1)\n  WARNING: CPU: 0 PID: 12760 at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 mpi3mr_bsg_request+0x6b12/0x7f10 [mpi3mr]\n\nThe cause of the WARN is 128 bytes memcpy to the 1 byte size array \"__u8\nreplay_buf[1]\" in the struct mpi3mr_bsg_in_reply_buf. The array is intended\nto be a flexible length array, so the WARN is a false positive.\n\nTo suppress the WARN, remove the constant number \u00271\u0027 from the array\ndeclaration and clarify that it has flexible length. Also, adjust the\nmemory allocation size to match the change."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-30T15:29:15.121Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5f0266044dc611563539705bff0b3e1545fbb6aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/f09318244c6cafd10aca741b9c01e0a2c362d43a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4d2772324f43cf5674ac3dbe3f74a7e656396716"
        },
        {
          "url": "https://git.kernel.org/stable/c/429846b4b6ce9853e0d803a2357bb2e55083adf0"
        }
      ],
      "title": "scsi: mpi3mr: Avoid memcpy field-spanning write WARNING",
      "x_generator": {
        "engine": "bippy-a5840b7849dd"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-36920",
    "datePublished": "2024-05-30T15:29:15.121Z",
    "dateReserved": "2024-05-30T15:25:07.068Z",
    "dateUpdated": "2024-08-02T03:43:49.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-36920\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-05-30T16:15:15.303\",\"lastModified\":\"2024-05-30T18:18:58.870\",\"vulnStatus\":\"Awaiting Analysis\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nscsi: mpi3mr: Avoid memcpy field-spanning write WARNING\\n\\nWhen the \\\"storcli2 show\\\" command is executed for eHBA-9600, mpi3mr driver\\nprints this WARNING message:\\n\\n  memcpy: detected field-spanning write (size 128) of single field \\\"bsg_reply_buf-\u003ereply_buf\\\" at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 (size 1)\\n  WARNING: CPU: 0 PID: 12760 at drivers/scsi/mpi3mr/mpi3mr_app.c:1658 mpi3mr_bsg_request+0x6b12/0x7f10 [mpi3mr]\\n\\nThe cause of the WARN is 128 bytes memcpy to the 1 byte size array \\\"__u8\\nreplay_buf[1]\\\" in the struct mpi3mr_bsg_in_reply_buf. The array is intended\\nto be a flexible length array, so the WARN is a false positive.\\n\\nTo suppress the WARN, remove the constant number \u00271\u0027 from the array\\ndeclaration and clarify that it has flexible length. Also, adjust the\\nmemory allocation size to match the change.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: scsi: mpi3mr: evitar escritura de extensi\u00f3n de campos de memcpy ADVERTENCIA Cuando se ejecuta el comando \\\"storcli2 show\\\" para eHBA-9600, el controlador mpi3mr imprime este mensaje de ADVERTENCIA: memcpy: extensi\u00f3n de campos detectada escriba (tama\u00f1o 128) de un solo campo \\\"bsg_reply_buf-\u0026gt;reply_buf\\\" en drivers/scsi/mpi3mr/mpi3mr_app.c:1658 (tama\u00f1o 1) ADVERTENCIA: CPU: 0 PID: 12760 en drivers/scsi/mpi3mr/mpi3mr_app.c:1658 mpi3mr_bsg_request+0x6b12/0x7f10 [mpi3mr] La causa de la ADVERTENCIA es 128 bytes de memoria en la matriz de tama\u00f1o de 1 byte \\\"__u8 replay_buf[1]\\\" en la estructura mpi3mr_bsg_in_reply_buf. La matriz est\u00e1 manipulada para ser una matriz de longitud flexible, por lo que WARN es un falso positivo. Para suprimir WARN, elimine el n\u00famero constante \u00271\u0027 de la declaraci\u00f3n de matriz y aclare que tiene una longitud flexible. Adem\u00e1s, ajuste el tama\u00f1o de la asignaci\u00f3n de memoria para que coincida con el cambio.\"}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/429846b4b6ce9853e0d803a2357bb2e55083adf0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4d2772324f43cf5674ac3dbe3f74a7e656396716\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5f0266044dc611563539705bff0b3e1545fbb6aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f09318244c6cafd10aca741b9c01e0a2c362d43a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.