In the Linux kernel, the following vulnerability has been resolved:
blk_iocost: fix more out of bound shifts
Recently running UBSAN caught few out of bound shifts in the iocforgivedebts() function:
UBSAN: shift-out-of-bounds in block/blk-iocost.c:2142:38 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... UBSAN: shift-out-of-bounds in block/blk-iocost.c:2144:30 shift exponent 80 is too large for 64-bit type 'u64' (aka 'unsigned long long') ... Call Trace: <IRQ> dumpstacklvl+0xca/0x130 _ubsanhandleshiftoutofbounds+0x22c/0x280 ? _lockacquire+0x6441/0x7c10 ioctimerfn+0x6cec/0x7750 ? blkiocostinit+0x720/0x720 ? calltimerfn+0x5d/0x470 calltimerfn+0xfa/0x470 ? blkiocostinit+0x720/0x720 _runtimer_base+0x519/0x700 ...
Actual impact of this issue was not identified but I propose to fix the undefined behaviour. The proposed fix to prevent those out of bound shifts consist of precalculating exponent before using it the shift operations by taking min value from the actual exponent and maximum possible number of bits.
{ "vanir_signatures": [ { "id": "CVE-2024-49933-26b7793d", "signature_type": "Function", "digest": { "function_hash": "122169518696340792371877812298001462301", "length": 1390.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bce8005ec0dcb23a58300e8522fe4a31da606fa", "target": { "file": "block/blk-iocost.c", "function": "ioc_forgive_debts" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-31ac6c81", "signature_type": "Function", "digest": { "function_hash": "122169518696340792371877812298001462301", "length": 1390.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59121bb38fdc01434ea3fe361ee02b59f036227f", "target": { "file": "block/blk-iocost.c", "function": "ioc_forgive_debts" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-4e77867d", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "236089302174884302226278924952863332258", "222691901849609925449095435422037364432", "310399705003841873631586570623124868474", "212041498395500418628152166827993499915", "324991679092936127113921864061335894059", "101378150990456527786062906533998349341", "77750846475303738957751687389837135575", "290534197750998862940012795644379557452", "308906566825460360151983696952860448668", "304153616209376318769284282150182416865", "310360034860201846538610547139885173815" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b120f151871eb47ce9f283c007af3f8ae1d990e", "target": { "file": "block/blk-iocost.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-52b8c2a6", "signature_type": "Function", "digest": { "function_hash": "122169518696340792371877812298001462301", "length": 1390.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ab2cfe19700fb3dde4c7dfec392acff34db3120", "target": { "file": "block/blk-iocost.c", "function": "ioc_forgive_debts" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-59856829", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "236089302174884302226278924952863332258", "222691901849609925449095435422037364432", "310399705003841873631586570623124868474", "212041498395500418628152166827993499915", "324991679092936127113921864061335894059", "101378150990456527786062906533998349341", "77750846475303738957751687389837135575", "290534197750998862940012795644379557452", "308906566825460360151983696952860448668", "304153616209376318769284282150182416865", "310360034860201846538610547139885173815" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@364022095bdd4108efdaaa68576afa4712a5d085", "target": { "file": "block/blk-iocost.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-6f1182d2", "signature_type": "Function", "digest": { "function_hash": "122169518696340792371877812298001462301", "length": 1390.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1b120f151871eb47ce9f283c007af3f8ae1d990e", "target": { "file": "block/blk-iocost.c", "function": "ioc_forgive_debts" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-7eaa82c4", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "236089302174884302226278924952863332258", "222691901849609925449095435422037364432", "310399705003841873631586570623124868474", "212041498395500418628152166827993499915", "324991679092936127113921864061335894059", "101378150990456527786062906533998349341", "77750846475303738957751687389837135575", "290534197750998862940012795644379557452", "308906566825460360151983696952860448668", "304153616209376318769284282150182416865", "310360034860201846538610547139885173815" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4ef9bef023d5c543cb0f3194ecacfd47ef590ec", "target": { "file": "block/blk-iocost.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-826fbd20", "signature_type": "Function", "digest": { "function_hash": "122169518696340792371877812298001462301", "length": 1390.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f61d509257d6a05763d05bf37943b35306522b1", "target": { "file": "block/blk-iocost.c", "function": "ioc_forgive_debts" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-a69cce5f", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "236089302174884302226278924952863332258", "222691901849609925449095435422037364432", "310399705003841873631586570623124868474", "212041498395500418628152166827993499915", "324991679092936127113921864061335894059", "101378150990456527786062906533998349341", "77750846475303738957751687389837135575", "290534197750998862940012795644379557452", "308906566825460360151983696952860448668", "304153616209376318769284282150182416865", "310360034860201846538610547139885173815" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1ab2cfe19700fb3dde4c7dfec392acff34db3120", "target": { "file": "block/blk-iocost.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-b88bf0f9", "signature_type": "Function", "digest": { "function_hash": "122169518696340792371877812298001462301", "length": 1390.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f4ef9bef023d5c543cb0f3194ecacfd47ef590ec", "target": { "file": "block/blk-iocost.c", "function": "ioc_forgive_debts" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-c09c3471", "signature_type": "Function", "digest": { "function_hash": "122169518696340792371877812298001462301", "length": 1390.0 }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@364022095bdd4108efdaaa68576afa4712a5d085", "target": { "file": "block/blk-iocost.c", "function": "ioc_forgive_debts" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-c4874d49", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "236089302174884302226278924952863332258", "222691901849609925449095435422037364432", "310399705003841873631586570623124868474", "212041498395500418628152166827993499915", "324991679092936127113921864061335894059", "101378150990456527786062906533998349341", "77750846475303738957751687389837135575", "290534197750998862940012795644379557452", "308906566825460360151983696952860448668", "304153616209376318769284282150182416865", "310360034860201846538610547139885173815" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1f61d509257d6a05763d05bf37943b35306522b1", "target": { "file": "block/blk-iocost.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-d47dfc92", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "236089302174884302226278924952863332258", "222691901849609925449095435422037364432", "310399705003841873631586570623124868474", "212041498395500418628152166827993499915", "324991679092936127113921864061335894059", "101378150990456527786062906533998349341", "77750846475303738957751687389837135575", "290534197750998862940012795644379557452", "308906566825460360151983696952860448668", "304153616209376318769284282150182416865", "310360034860201846538610547139885173815" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@59121bb38fdc01434ea3fe361ee02b59f036227f", "target": { "file": "block/blk-iocost.c" }, "deprecated": false, "signature_version": "v1" }, { "id": "CVE-2024-49933-f09d00cb", "signature_type": "Line", "digest": { "threshold": 0.9, "line_hashes": [ "236089302174884302226278924952863332258", "222691901849609925449095435422037364432", "310399705003841873631586570623124868474", "212041498395500418628152166827993499915", "324991679092936127113921864061335894059", "101378150990456527786062906533998349341", "77750846475303738957751687389837135575", "290534197750998862940012795644379557452", "308906566825460360151983696952860448668", "304153616209376318769284282150182416865", "310360034860201846538610547139885173815" ] }, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9bce8005ec0dcb23a58300e8522fe4a31da606fa", "target": { "file": "block/blk-iocost.c" }, "deprecated": false, "signature_version": "v1" } ] }