In the Linux kernel, the following vulnerability has been resolved:
dm: fix a buffer overflow in ioctl processing
Tony Asleson (using Claude) found a buffer overflow in dm-ioctl in the
function retrieve_status:
- The code in retrieve_status checks that the output string fits into
the output buffer and writes the output string there
- Then, the code aligns the "outptr" variable to the next 8-byte
boundary:
outptr = align_ptr(outptr);
- The alignment doesn't check overflow, so outptr could point past the
buffer end
- The "for" loop is iterated again, it executes:
remaining = len - (outptr - outbuf);
- If "outptr" points past "outbuf + len", the arithmetics wraps around
and the variable "remaining" contains unusually high number
- With "remaining" being high, the code writes more data past the end of
the buffer
Luckily, this bug has no security implications because:
- Only root can issue device mapper ioctls
- The commonly used libraries that communicate with device mapper
(libdevmapper and devicemapper-rs) use buffer size that is aligned to
8 bytes - thus, "outptr = align_ptr(outptr)" can't overshoot the input
buffer and the bug can't happen accidentally