CVE-2024-57890

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-57890
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-57890.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-57890
Downstream
Related
Published
2025-01-15T13:05:42.690Z
Modified
2026-03-11T07:51:24.354462Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
RDMA/uverbs: Prevent integer overflow issue
Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/uverbs: Prevent integer overflow issue

In the expression "cmd.wqesize * cmd.wrcount", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping. Then we pass the result to uverbsrequestnextptr() which also could potentially wrap. The "cmd.sgecount * sizeof(struct ibuverbssge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems.

This patch does two things. First, I've re-arranged the condition in uverbsrequestnextptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math. Then I've modified all the callers to use sizemul() for the multiplications.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/57xxx/CVE-2024-57890.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
67cdb40ca444c09853ab4d8a41cf547ac26a4de4
Fixed
c57721b24bd897338a81a0ca5fff41600f0f1ad1
Fixed
42a6eb4ed7a9a41ba0b83eb0c7e0225b5fca5608
Fixed
c2f961c46ea0e5274c5c320d007c2dd949cf627a
Fixed
346db03e9926ab7117ed9bf19665699c037c773c
Fixed
b92667f755749cf10d9ef1088865c555ae83ffb7
Fixed
b3ef4ae713360501182695dd47d6b4f6e1a43eb8
Fixed
d0257e089d1bbd35c69b6c97ff73e3690ab149a9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-57890.json"