Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 25 Aug 2021 10:40:29 +0800
From: butt3rflyh4ck <>
Subject: Linux kernel: qrtr: another out-of-bound Read in
 qrtr_endpoint_post in net/qrtr/qrtr.c

Hi, There was another out-of-bound read bug in qrtr_endpoint_post in
net/qrtr/qrtr.c in 5.14.0-rc6+ and reproduced it.

This check in  qrtr_endpoint_post was incomplete, did not consider size is 0:
if (len != ALIGN(size, 4) + hdrlen)
                goto err;
if size from qrtr_hdr is 0, the result of ALIGN(size, 4) will be 0,
In case of len == hdrlen and size == 0 in header this check won't fail and
 if (cb->type == QRTR_TYPE_NEW_SERVER) { /* Remote node endpoint can
bridge other distant nodes */
             const struct qrtr_ctrl_pkt *pkt = data + hdrlen;
             qrtr_node_assign(node, le32_to_cpu(pkt->server.node));
will also read out of bound from data, which is hdrlen allocated block.

#analyze and some details

now not available upstream.

*2021/8/17 - Vulnerability reported to
*2021/8/20 - Vulnerability confirmed and patched.
*2021/8/23 - Vulnerability reported to
*2021/8/25 - Opened on

Active Defense Lab of Venustech.


Active Defense Lab of Venustech

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.