Bug 2239847 (CVE-2023-42755, ZDI-CAN-18387)

Summary:	CVE-2023-42755 kernel: rsvp: out-of-bounds read in rsvp_classify()
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, allarkin, bhu, chwhite, dbohanno, debarbos, dfreiber, dvlasenk, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mcascell, nmurray, ptalbert, rkeshri, rogbas, rrobaina, rvrbovsk, rysulliv, scweaver, security-response-team, tglozar, tyberry, vkumar, wcosta, williams, wmealing, ycote
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 6.3-rc1	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2227310, 2227311
Bug Blocks:	2238729, 2258363

Description Patrick Del Bello 2023-09-20 13:54:37 UTC

A flaw was found in rsvp_change(). The root cause is an slab-out-of-bound access, but since the offset to the original pointer is an `unsign int` fully controlled by users, the behavior is usually a wild pointer access.

Comment 5 Mauro Matteo Cascella 2023-09-28 16:02:58 UTC

The rsvp classifier has been retired upstream:
https://github.com/torvalds/linux/commit/265b4da82dbf5df04bee5a5d46b7474b1aaf326a

Comment 6 Mauro Matteo Cascella 2023-09-28 16:11:50 UTC

*** Bug 2226790 has been marked as a duplicate of this bug. ***

Comment 11 Alex 2024-02-11 09:38:54 UTC

*** Bug 2258363 has been marked as a duplicate of this bug. ***

Comment 12 Alex 2024-02-11 09:41:42 UTC

*** Bug 2258364 has been marked as a duplicate of this bug. ***

Comment 13 errata-xmlrpc 2024-05-22 09:14:47 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:2950 https://access.redhat.com/errata/RHSA-2024:2950

Comment 14 errata-xmlrpc 2024-05-22 09:52:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:3138 https://access.redhat.com/errata/RHSA-2024:3138