An issue was discovered in net/ceph/messengerv2.c in the Linux kernel before 6.4.5. There is an integer signedness error, leading to a buffer overflow and remote code execution via HELLO or one of the AUTH frames. This occurs because of an untrusted length taken from a TCP packet in cephdecode_32.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-44466.json"
[
{
"target": {
"file": "net/ceph/messenger_v2.c"
},
"digest": {
"line_hashes": [
"91423269847972797390048510324473862005",
"117678650489809056281265976489917797743",
"228786637846735023930008877172773132140",
"298298445342187864285150374339378904506",
"116681421563089561163136513869747851776",
"310317213836405379534568209993470075919",
"27831686571190810842695486044893779004",
"231508787019101790887678808840843113282",
"99726529102124971673627821559735359479",
"249304448095715810011395724625522447369",
"127042022396324619753071633790187346450",
"53369497889098648401716805192334897380",
"207021337274121564077692965157477606293",
"274470147489937408688456928151213432517",
"335230449728946214476609566576410551735",
"243090548842505917737590156584291876557",
"21200720801612626310413375690494471950",
"324341721966314171692412040956648199481",
"47703910360559892561721594781088019257",
"187050749903861454154754576826548964333",
"225475019078531862268859282784642425366",
"33726317531196202416785496865492838771",
"232673012440857596487716541955791683171",
"271050917423040343151333027503792606968",
"218883620033635820904905546661890735945",
"222145888120211691382528042522159475571",
"22730769416009613597985832310157670463",
"265487967878627839225701890185936213979"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-44466-30aa29c0",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "net/ceph/messenger_v2.c",
"function": "decode_preamble"
},
"digest": {
"length": 1506.0,
"function_hash": "34967237666377990190436350241380334268"
},
"signature_type": "Function",
"id": "CVE-2023-44466-52cbcbe3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "net/ceph/messenger_v2.c",
"function": "head_onwire_len"
},
"digest": {
"length": 356.0,
"function_hash": "159560394868106280558235989162121636212"
},
"signature_type": "Function",
"id": "CVE-2023-44466-8579ee51",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "net/ceph/messenger_v2.c",
"function": "__tail_onwire_len"
},
"digest": {
"length": 300.0,
"function_hash": "288246055088180256169657387102916831911"
},
"signature_type": "Function",
"id": "CVE-2023-44466-d1046250",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-44466.json"
[
{
"target": {
"file": "net/ceph/messenger_v2.c",
"function": "decode_preamble"
},
"digest": {
"length": 1506.0,
"function_hash": "34967237666377990190436350241380334268"
},
"signature_type": "Function",
"id": "CVE-2023-44466-44bf301a",
"source": "https://github.com/torvalds/linux/commit/a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "net/ceph/messenger_v2.c",
"function": "__tail_onwire_len"
},
"digest": {
"length": 300.0,
"function_hash": "288246055088180256169657387102916831911"
},
"signature_type": "Function",
"id": "CVE-2023-44466-8414e780",
"source": "https://github.com/torvalds/linux/commit/a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "net/ceph/messenger_v2.c",
"function": "head_onwire_len"
},
"digest": {
"length": 356.0,
"function_hash": "159560394868106280558235989162121636212"
},
"signature_type": "Function",
"id": "CVE-2023-44466-8654b691",
"source": "https://github.com/torvalds/linux/commit/a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
},
{
"target": {
"file": "net/ceph/messenger_v2.c"
},
"digest": {
"line_hashes": [
"91423269847972797390048510324473862005",
"117678650489809056281265976489917797743",
"228786637846735023930008877172773132140",
"298298445342187864285150374339378904506",
"116681421563089561163136513869747851776",
"310317213836405379534568209993470075919",
"27831686571190810842695486044893779004",
"231508787019101790887678808840843113282",
"99726529102124971673627821559735359479",
"249304448095715810011395724625522447369",
"127042022396324619753071633790187346450",
"53369497889098648401716805192334897380",
"207021337274121564077692965157477606293",
"274470147489937408688456928151213432517",
"335230449728946214476609566576410551735",
"243090548842505917737590156584291876557",
"21200720801612626310413375690494471950",
"324341721966314171692412040956648199481",
"47703910360559892561721594781088019257",
"187050749903861454154754576826548964333",
"225475019078531862268859282784642425366",
"33726317531196202416785496865492838771",
"232673012440857596487716541955791683171",
"271050917423040343151333027503792606968",
"218883620033635820904905546661890735945",
"222145888120211691382528042522159475571",
"22730769416009613597985832310157670463",
"265487967878627839225701890185936213979"
],
"threshold": 0.9
},
"signature_type": "Line",
"id": "CVE-2023-44466-aedf7cd9",
"source": "https://github.com/torvalds/linux/commit/a282a2f10539dce2aa619e71e1817570d557fc97",
"deprecated": false,
"signature_version": "v1"
}
]