Linux mlx5 RDMA: Fix stack out-of-bounds read in cc_params_decbuf

Vulnerability Summary Vulnerability Overview Title: RDMA/mlx5: Fix stack out-of-bounds read in cc_params_decbuf Commit Information: - Author: Leon Romanovsky - Committer: Greg Kroah-Hartman - Commit Hash: - Date: 2020-06-20 12:13:50 +0300 Problem Description: - reads a connection parameter (u32) but handles it as a signed . - When is set to , returns 12 (storing only 11 bytes), but treats 12 as valid and reads one byte (past the buffer end). - Fix: Adjust the buffer size to accommodate the largest unsigned decimal number (10 bytes), parse using , and use to reflect what actually stores. Scope of Impact Affected File: Impact: Stack out-of-bounds read, which may lead to information leakage or a crash. Fix Details Fix Commit: ("RDMA/mlx5: Add debug control parameters for congestion control") Fix Contents: - Changed parsing of from to , parsing with . - Adjusted buffer size to match the largest unsigned decimal number (10 bytes). - Used to ensure only the actually stored number of bytes is read. POC / Exploitation Code ```c // Before the fix (vulnerable code) static int cc_params_decbuf(void buf, char user_buf, size_t count, int offset) { int offset = param->offset; u32 var = 0; int ret; ret = mlx5_ib_get_cc_params(param->dev, param->port_num, offset, &var); if (ret) return ret; ret = scnprintf(buf, sizeof(buf), "%d\n", var); if (ret offset; u32 var = 0; int ret; ret = mlx5_ib_get_cc_params(param->dev, param->port_num, offset, &var); if (ret) return ret; ret = scnprintf(buf, sizeof(buf), "%lu\n", var); if (ret < 0) return ret; return simple_read_from_buffer(buf, count, pos, buf, ret); }

Goal Reached Thanks to every supporter — we hit 100%!

Linux mlx5 RDMA: Fix stack out-of-bounds read in cc_params_decbuf