In the Linux kernel, the following vulnerability has been resolved:
md/raid10: check slab-out-of-bounds in mdbitmapget_counter
If we write a large number to md/bitmapsetbits, mdbitmapcheckpage() will return -EINVAL because 'page >= bitmap->pages', but the return value was not checked immediately in mdbitmapget_counter() in order to set *blocks value and slab-out-of-bounds occurs.
Move check of 'page >= bitmap->pages' to mdbitmapget_counter() and return directly if true.
{ "vanir_signatures": [ { "id": "CVE-2023-53357-02582b6d", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@374fb914304d9b500721007f3837ea8f1f9a2418", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } }, { "id": "CVE-2023-53357-0336aee2", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b0b971fe7d61411ede63c3291764dbde1577ef2c", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } }, { "id": "CVE-2023-53357-2ac45926", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39fa14e824acfd470db4f42c354297456bd82b53", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } }, { "id": "CVE-2023-53357-7e2f664c", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bea301c046110bf421a3ce153fb868cb8d618e90", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } }, { "id": "CVE-2023-53357-859fcbe0", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@be1a3ec63a840cc9e59a033acf154f56255699a1", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } }, { "id": "CVE-2023-53357-9269d9aa", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@152bb26796ff054af50b2ee1b3ca56e364e4f61b", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } }, { "id": "CVE-2023-53357-e092c179", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@301867b1c16805aebbc306aafa6ecdc68b73c7e5", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } }, { "id": "CVE-2023-53357-f7eb6a10", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a134dd582c0d5b6068efa308bd485cf1d00b3f65", "deprecated": false, "signature_version": "v1", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "278337239175800479944304127447094859790", "310930207213236219681538911579209905085", "292634653524098514451486418951105205297", "22508437347626765522920831321687422846", "145867497985908902984571934185960869167", "226984800061034403979488080792555078372", "12238783373717025027820900406816452258", "126434606264571030474155984205954242517", "260954928393885460658790349037608536709" ] }, "target": { "file": "drivers/md/md-bitmap.c" } } ] }