Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-24170

buffer overrun possible in rasdaemon

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Undefined Undefined
    • rhel-9.5
    • rhel-9.4
    • rasdaemon
    • None
    • None
    • None
    • Upstream
    • rhel-sst-kernel-ft
    • ssg_core_kernel
    • 17
    • 22
    • 2
    • Dev ack
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • All
    • None

      3. rasdaemon-0.6.7/mce-amd-smca.c:914: assignment: Assigning: "bank_type" = "s_hwid->bank_type".
      7. rasdaemon-0.6.7/mce-amd-smca.c:926: cond_at_most: Checking "bank_type >= 64U" implies that "bank_type" and "s_hwid->bank_type" may be up to 63 on the false branch.
      14. rasdaemon-0.6.7/mce-amd-smca.c:942: overrun-local: Overrunning array "smca_mce_descs" of 38 16-byte elements at element index 63 (byte offset 1023) using index "bank_type" (which evaluates to 63).

      1. 940| /* Only print the descriptor of valid extended error code */
      2. 941| if (xec < smca_mce_descs[bank_type].num_descs)
      3. 942|-> mce_snprintf(e->mcastatus_msg,
      4. 943| "%s. Ext Err Code: %d",
      5. 944| smca_mce_descs[bank_type].descs[xec],

      found by covscan. Likely present upstream.

              arozansk Aristeu Rozanski
              arozansk Aristeu Rozanski
              Aristeu Rozanski Aristeu Rozanski
              Jiri Dluhos Jiri Dluhos
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: