In the Linux kernel, the following vulnerability has been resolved:
libceph: just wait for more data to be available on the socket
A short read may occur while reading the message footer from the socket. Later, when the socket is ready for another read, the messenger invokes all readpartial*() handlers, including readpartialsparsemsgdata(). The expectation is that readpartialsparsemsgdata() would bail, allowing the messenger to invoke read_partial() for the footer and pick up where it left off.
However readpartialsparsemsgdata() violates that and ends up calling into the state machine in the OSD client. The sparse-read state machine assumes that it's a new op and interprets some piece of the footer as the sparse-read header and returns bogus extents/data length, etc.
To determine whether readpartialsparsemsgdata() should bail, let's reuse cursor->totalresid. Because once it reaches to zero that means all the extents and data have been successfully received in last read, else it could break out when partially reading any of the extents and data. And then osdsparse_read() could continue where it left off.
[ idryomov: changelog ]
{ "vanir_signatures": [ { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "function": "prepare_message_data", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 136.0, "function_hash": "221566140851562408857420956317246191799" }, "id": "CVE-2023-52636-095ed8c3", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "function": "decrypt_tail", "file": "net/ceph/messenger_v2.c" }, "digest": { "length": 1381.0, "function_hash": "34484230764052375179680682311757190336" }, "id": "CVE-2023-52636-144f7391", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "function": "get_reply", "file": "net/ceph/osd_client.c" }, "digest": { "length": 1668.0, "function_hash": "272134129438779642373995453601166007956" }, "id": "CVE-2023-52636-168cac32", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "file": "net/ceph/messenger_v2.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "16284004415384343960171796824740224213", "69465238405429041714445904265223170265", "157953663930337556258673241785718363107", "155853124382072944983744583101969105607", "16526971868748809780099850886933583604", "200930638598568388371664771794398844835", "149217325211072536023314339354566211669", "280571189555108865352870142674575551915" ] }, "id": "CVE-2023-52636-1e93f15e", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "function": "get_reply", "file": "net/ceph/osd_client.c" }, "digest": { "length": 1668.0, "function_hash": "272134129438779642373995453601166007956" }, "id": "CVE-2023-52636-20153a8d", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "function": "read_partial_sparse_msg_data", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 809.0, "function_hash": "59371873060516406342374248912456352269" }, "id": "CVE-2023-52636-397bd473", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "file": "net/ceph/osd_client.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "236035960571822624133520396151925091876", "63644294329575821204635274926608591203", "258506082650833090393006447933344270263", "335720300096655109146822467658648805521", "48917479496417379922588183005522601888", "139776462922301399855720019423334057250", "58142365749398252664810338521423023596", "270436377280998752709266227416048691550", "147397224364451448355861148593059222110", "11959306762824274116969258652515953849", "290299706898673515036149024127617997512" ] }, "id": "CVE-2023-52636-482f4c67", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "file": "net/ceph/osd_client.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "236035960571822624133520396151925091876", "63644294329575821204635274926608591203", "258506082650833090393006447933344270263", "335720300096655109146822467658648805521", "48917479496417379922588183005522601888", "139776462922301399855720019423334057250", "58142365749398252664810338521423023596", "270436377280998752709266227416048691550", "147397224364451448355861148593059222110", "11959306762824274116969258652515953849", "290299706898673515036149024127617997512" ] }, "id": "CVE-2023-52636-55b985a9", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "file": "net/ceph/messenger_v2.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "16284004415384343960171796824740224213", "69465238405429041714445904265223170265", "157953663930337556258673241785718363107", "155853124382072944983744583101969105607", "16526971868748809780099850886933583604", "200930638598568388371664771794398844835", "149217325211072536023314339354566211669", "280571189555108865352870142674575551915" ] }, "id": "CVE-2023-52636-568dd5f6", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "function": "read_partial_message", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 4292.0, "function_hash": "26166053723490237557800758208230397613" }, "id": "CVE-2023-52636-57507917", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "function": "prep_next_sparse_read", "file": "net/ceph/osd_client.c" }, "digest": { "length": 1889.0, "function_hash": "99809316940420133764660005891479589224" }, "id": "CVE-2023-52636-58e87c26", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "function": "decrypt_tail", "file": "net/ceph/messenger_v2.c" }, "digest": { "length": 1381.0, "function_hash": "34484230764052375179680682311757190336" }, "id": "CVE-2023-52636-6b22a9af", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "function": "prepare_message_data", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 136.0, "function_hash": "221566140851562408857420956317246191799" }, "id": "CVE-2023-52636-726da3d0", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "function": "prepare_read_tail_plain", "file": "net/ceph/messenger_v2.c" }, "digest": { "length": 829.0, "function_hash": "258100827111953359768349213098081884760" }, "id": "CVE-2023-52636-7446a8ed", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "file": "net/ceph/osd_client.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "236035960571822624133520396151925091876", "63644294329575821204635274926608591203", "258506082650833090393006447933344270263", "335720300096655109146822467658648805521", "48917479496417379922588183005522601888", "139776462922301399855720019423334057250", "58142365749398252664810338521423023596", "270436377280998752709266227416048691550", "147397224364451448355861148593059222110", "11959306762824274116969258652515953849", "290299706898673515036149024127617997512" ] }, "id": "CVE-2023-52636-74745906", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "file": "include/linux/ceph/messenger.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "167886888476198723942690568427305930300", "13902889826882968569463975098161448841", "226595793533239804261330762212957851270", "262444200150333182412949673174381194087" ] }, "id": "CVE-2023-52636-7ee2870c", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "function": "read_partial_message", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 4292.0, "function_hash": "26166053723490237557800758208230397613" }, "id": "CVE-2023-52636-84c1eb62", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "function": "read_partial_sparse_msg_data", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 809.0, "function_hash": "59371873060516406342374248912456352269" }, "id": "CVE-2023-52636-85907b97", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "file": "include/linux/ceph/messenger.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "167886888476198723942690568427305930300", "13902889826882968569463975098161448841", "226595793533239804261330762212957851270", "262444200150333182412949673174381194087" ] }, "id": "CVE-2023-52636-88dd63d9", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "function": "prep_next_sparse_read", "file": "net/ceph/osd_client.c" }, "digest": { "length": 1889.0, "function_hash": "99809316940420133764660005891479589224" }, "id": "CVE-2023-52636-8befb3bd", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "file": "net/ceph/messenger_v1.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "329940832847026225348744859464413670253", "179728672916310516323932396065429566722", "308383133003803348890979640633303224848", "83786159958427005303078996734396011603", "336183571321777066929333681807131329212", "31146430332241600875432392538261564179", "154335487121035030564519908045465159438", "111762542496598368818927162885952256222", "122002002730988791705762648611642767188", "125418180029150410498557103580182779822", "80237263927780861459426598033821477718", "1574619659767945137179618999397927807", "303826162868700555995815701118026630549", "52671604819874369180164548843445360008", "255081456791019216056508042758666128453", "145653541533303026547052082775130278015", "267346365717446088666233062489122382949", "339946167568374509124570469088127373369", "338708731054076028241007968802356627970", "324819655019707613941259331802146367946", "176608257867870851306069730167782962716", "89501101249255283646382015353522449067", "178372530883353374725362974151325652378", "338649822726678070690387874959200122962", "278727456723832272287197847106018283078", "247433378520902732788810009452447275430", "150285511710474911942097239452090145432", "17383889462845130455873897035145934338", "248028729243809035064416144271526290862" ] }, "id": "CVE-2023-52636-8ddcfbcb", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "file": "net/ceph/messenger_v1.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "329940832847026225348744859464413670253", "179728672916310516323932396065429566722", "308383133003803348890979640633303224848", "83786159958427005303078996734396011603", "336183571321777066929333681807131329212", "31146430332241600875432392538261564179", "154335487121035030564519908045465159438", "111762542496598368818927162885952256222", "122002002730988791705762648611642767188", "125418180029150410498557103580182779822", "80237263927780861459426598033821477718", "1574619659767945137179618999397927807", "303826162868700555995815701118026630549", "52671604819874369180164548843445360008", "255081456791019216056508042758666128453", "145653541533303026547052082775130278015", "267346365717446088666233062489122382949", "339946167568374509124570469088127373369", "338708731054076028241007968802356627970", "324819655019707613941259331802146367946", "176608257867870851306069730167782962716", "89501101249255283646382015353522449067", "178372530883353374725362974151325652378", "338649822726678070690387874959200122962", "278727456723832272287197847106018283078", "247433378520902732788810009452447275430", "150285511710474911942097239452090145432", "17383889462845130455873897035145934338", "248028729243809035064416144271526290862" ] }, "id": "CVE-2023-52636-95970290", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "function": "prep_next_sparse_read", "file": "net/ceph/osd_client.c" }, "digest": { "length": 1889.0, "function_hash": "99809316940420133764660005891479589224" }, "id": "CVE-2023-52636-990face5", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "file": "include/linux/ceph/messenger.h" }, "digest": { "threshold": 0.9, "line_hashes": [ "167886888476198723942690568427305930300", "13902889826882968569463975098161448841", "226595793533239804261330762212957851270", "262444200150333182412949673174381194087" ] }, "id": "CVE-2023-52636-a01987ac", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "function": "prepare_message_data", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 136.0, "function_hash": "221566140851562408857420956317246191799" }, "id": "CVE-2023-52636-a3410aa2", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "function": "read_partial_message", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 4292.0, "function_hash": "26166053723490237557800758208230397613" }, "id": "CVE-2023-52636-aea3c5f8", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "function": "read_partial_sparse_msg_data", "file": "net/ceph/messenger_v1.c" }, "digest": { "length": 809.0, "function_hash": "59371873060516406342374248912456352269" }, "id": "CVE-2023-52636-b9573e04", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "file": "net/ceph/messenger_v2.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "16284004415384343960171796824740224213", "69465238405429041714445904265223170265", "157953663930337556258673241785718363107", "155853124382072944983744583101969105607", "16526971868748809780099850886933583604", "200930638598568388371664771794398844835", "149217325211072536023314339354566211669", "280571189555108865352870142674575551915" ] }, "id": "CVE-2023-52636-c0af1fd0", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "function": "prepare_read_tail_plain", "file": "net/ceph/messenger_v2.c" }, "digest": { "length": 829.0, "function_hash": "258100827111953359768349213098081884760" }, "id": "CVE-2023-52636-c9fa04fd", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da9c33a70f095d5d55c36d0bfeba969e31de08ae", "target": { "function": "prepare_read_tail_plain", "file": "net/ceph/messenger_v2.c" }, "digest": { "length": 829.0, "function_hash": "258100827111953359768349213098081884760" }, "id": "CVE-2023-52636-ddb80c7f", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "function": "decrypt_tail", "file": "net/ceph/messenger_v2.c" }, "digest": { "length": 1381.0, "function_hash": "34484230764052375179680682311757190336" }, "id": "CVE-2023-52636-e5d6cce9", "deprecated": false, "signature_type": "Function", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bd9442e553ab8bf74b8be3b3c0a43bf4af4dc9b8", "target": { "file": "net/ceph/messenger_v1.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "329940832847026225348744859464413670253", "179728672916310516323932396065429566722", "308383133003803348890979640633303224848", "83786159958427005303078996734396011603", "336183571321777066929333681807131329212", "31146430332241600875432392538261564179", "154335487121035030564519908045465159438", "111762542496598368818927162885952256222", "122002002730988791705762648611642767188", "125418180029150410498557103580182779822", "80237263927780861459426598033821477718", "1574619659767945137179618999397927807", "303826162868700555995815701118026630549", "52671604819874369180164548843445360008", "255081456791019216056508042758666128453", "145653541533303026547052082775130278015", "267346365717446088666233062489122382949", "339946167568374509124570469088127373369", "338708731054076028241007968802356627970", "324819655019707613941259331802146367946", "176608257867870851306069730167782962716", "89501101249255283646382015353522449067", "178372530883353374725362974151325652378", "338649822726678070690387874959200122962", "278727456723832272287197847106018283078", "247433378520902732788810009452447275430", "150285511710474911942097239452090145432", "17383889462845130455873897035145934338", "248028729243809035064416144271526290862" ] }, "id": "CVE-2023-52636-ecdf7ff2", "deprecated": false, "signature_type": "Line", "signature_version": "v1" }, { "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8e46a2d068c92a905d01cbb018b00d66991585ab", "target": { "function": "get_reply", "file": "net/ceph/osd_client.c" }, "digest": { "length": 1668.0, "function_hash": "272134129438779642373995453601166007956" }, "id": "CVE-2023-52636-f6e7062d", "deprecated": false, "signature_type": "Function", "signature_version": "v1" } ] }