Bug 2266210 (CVE-2023-52466)

Summary: CVE-2023-52466 kernel: out-of-bounds read in pci_dev_for_each_resource()
Product: [Other] Security Response Reporter: Rohit Keshri <rkeshri>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, allarkin, aquini, bhu, chwhite, cye, cyin, dbohanno, debarbos, dfreiber, drow, dvlasenk, esandeen, ezulian, hkrzesin, jarod, jburrell, jdenham, jfaracco, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, ldoskova, lgoncalv, lzampier, mleitner, mmilgram, mstowell, nmurray, ptalbert, rparrazo, rrobaina, rvrbovsk, scweaver, sukulkar, tglozar, vkumar, vsroka, wcosta, williams, wmealing, ycote, ykopkova, zhijwang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds read flaw was found in pci_dev_for_each_resource() in the Linux Kernel. The pointer in the pci_dev_for_each_resource() may be wrong. For example, it might be used for the out-of-bounds read. This issue was identified by the Coverity static analysis tool, which flagged a pointer (res) that could be used incorrectly, potentially leading to accessing memory outside its bounds.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2266211    
Bug Blocks: 2266208    

Description Rohit Keshri 2024-02-27 05:00:13 UTC 
In the Linux kernel, the following vulnerability has been resolved:

PCI: Avoid potential out-of-bounds read in pci_dev_for_each_resource()

Coverity complains that pointer in the pci_dev_for_each_resource() may be
wrong, i.e., might be used for the out-of-bounds read.

There is no actual issue right now because we have another check afterwards
and the out-of-bounds read is not being performed. In any case it's better
code with this fixed, hence the proposed change.

As Jonas pointed out "It probably makes the code slightly less performant
as res will now be checked for being not NULL (which will always be true),
but I doubt it will be significant (or in any hot paths)."

https://git.kernel.org/stable/c/3171e46d677a668eed3086da78671f1e4f5b8405
https://git.kernel.org/stable/c/5b3e25efe16e06779a9a7c7610217c1b921ec179
https://git.kernel.org/stable/c/bd26159dcaaa3e9a927070efd348e7ce7e5ee933
Comment 1 Rohit Keshri 2024-02-27 05:06:07 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2266211]
Comment 3 Justin M. Forbes 2024-02-27 19:19:18 UTC 
This was fixed for Fedora with the 6.6.14 stable kernel updates.
Comment 8 errata-xmlrpc 2024-11-12 09:18:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315
Comment 9 Keith Grant 2025-02-27 17:53:32 UTC 
This CVE was rejected by upstream on Sun Mar  3 07:31:36 2024 +0000