Linux DLM dma-buf OOB Write CVE-2024-41090 Analysis & Fix

Vulnerability Overview Vulnerability ID: CVE-2024-41090 Vulnerability Type: Out-of-bounds write Affected Component: function in Vulnerability Description: - When processing the message, this function does not validate the length of and directly copies it into the fixed-size . - An attacker can trigger an out-of-bounds write by sending an overly long field, leading to heap memory corruption. - The vulnerability is located in the function, specifically at the call. Scope of Impact Affected Versions: Linux kernel 6.10 and earlier (specific versions need to be confirmed via the CVE database) Affected Module: Trigger Conditions: - The attacker must be able to send messages with a length exceeding . - This is typically triggered via the DLM (Distributed Lock Manager) protocol. Fix Details Fix Commit: Fix Content: - Added length validation for in the function to ensure it does not exceed . - If the length exceeds the limit, the message is rejected and an error log is printed. Patched Code Snippet: ```c if (strlen(msg->name) > DLM_LOCKED_NAME_MAX) { mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_locks mres->mres_lock

Goal Reached Thanks to every supporter — we hit 100%!

Linux DLM dma-buf OOB Write CVE-2024-41090 Analysis & Fix

More from this source