In the Linux kernel, the following vulnerability has been resolved:
md: raid1: fix potential OOB in raid1removedisk()
If rddev->raiddisk is greater than mddev->raiddisks, there will be an out-of-bounds in raid1removedisk(). We have already found similar reports as follows:
1) commit d17f744e883b ("md-raid10: fix KASAN warning") 2) commit 1ebc2cec0b7d ("dm raid: fix KASAN warning in raid5removedisk")
Fix this bug by checking whether the "number" variable is valid.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f96c0665f9f4cf70130c9757750dc43dc679c82",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-0831d3d6",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91fbd4e75cb573f44d2619a9dc2f9ba927040760",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-1691d546",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b0472b50bcf0f19a5119b00a53b63579c8e1e4d",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-2e062878",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@beedf40f73939f248c81802eda08a2a8148ea13e",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-3e24a823",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a68f2286be56fb3a6f9fa0e269c04b5e6c6e24",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-402c7b34",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7d853b4590fc20e90dd50e346c02811a8c5b08",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-71a43410",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25a68f2286be56fb3a6f9fa0e269c04b5e6c6e24",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-7e15c4cb",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bdb92eaf645e312975357adc3c4e9523b6e67f1",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-9331d2a6",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7993cfc041481a3a9cd4a3858088fc846b8ccaf7",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-9406e638",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7993cfc041481a3a9cd4a3858088fc846b8ccaf7",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-a5926063",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@beedf40f73939f248c81802eda08a2a8148ea13e",
"digest": {
"line_hashes": [
"47403731099850612596069840406617647952",
"277812943156172449677865572524889830420",
"280159828795546365794636550035419180427",
"107029183202099172126032907936023169938"
],
"threshold": 0.9
},
"signature_type": "Line",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c"
},
"id": "CVE-2023-53722-af397b2f",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@91fbd4e75cb573f44d2619a9dc2f9ba927040760",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-af7d1651",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f96c0665f9f4cf70130c9757750dc43dc679c82",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-ce238739",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4f7d853b4590fc20e90dd50e346c02811a8c5b08",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-e22b44ed",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8b0472b50bcf0f19a5119b00a53b63579c8e1e4d",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-eff8309d",
"deprecated": false
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4bdb92eaf645e312975357adc3c4e9523b6e67f1",
"digest": {
"function_hash": "2808376139431399618563338838845093089",
"length": 1310.0
},
"signature_type": "Function",
"signature_version": "v1",
"target": {
"file": "drivers/md/raid1.c",
"function": "raid1_remove_disk"
},
"id": "CVE-2023-53722-fbcc34e5",
"deprecated": false
}
]