GHSA-FCX4-QHGW-9Q8F
Vulnerability from github – Published: 2024-12-24 12:30 – Updated: 2025-11-03 21:31In the Linux kernel, the following vulnerability has been resolved:
svcrdma: Address an integer overflow
Dan Carpenter reports:
Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data structure") from Jun 22, 2020 (linux-next), leads to the following Smatch static checker warning:
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() warn: potential user controlled sizeof overflow 'segcount * 4 * 4'
net/sunrpc/xprtrdma/svc_rdma_recvfrom.c 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt rctxt) 489 { 490 u32 segcount; 491 __be32 p; 492 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) ^^^^^^^^
494 return false; 495 496 /* A bogus segcount causes this buffer overflow check to fail. */ 497 p = xdr_inline_decode(&rctxt->rc_stream,--> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p));
segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will have an integer overflow and some those values will be accepted by xdr_inline_decode().
{
"affected": [],
"aliases": [
"CVE-2024-53151"
],
"database_specific": {
"cwe_ids": [
"CWE-190"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-24T12:15:23Z",
"severity": "MODERATE"
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsvcrdma: Address an integer overflow\n\nDan Carpenter reports:\n\u003e Commit 78147ca8b4a9 (\"svcrdma: Add a \"parsed chunk list\" data\n\u003e structure\") from Jun 22, 2020 (linux-next), leads to the following\n\u003e Smatch static checker warning:\n\u003e\n\u003e\tnet/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk()\n\u003e\twarn: potential user controlled sizeof overflow \u0027segcount * 4 * 4\u0027\n\u003e\n\u003e net/sunrpc/xprtrdma/svc_rdma_recvfrom.c\n\u003e 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt)\n\u003e 489 {\n\u003e 490 u32 segcount;\n\u003e 491 __be32 *p;\n\u003e 492\n\u003e 493 if (xdr_stream_decode_u32(\u0026rctxt-\u003erc_stream, \u0026segcount))\n\u003e ^^^^^^^^\n\u003e\n\u003e 494 return false;\n\u003e 495\n\u003e 496 /* A bogus segcount causes this buffer overflow check to fail. */\n\u003e 497 p = xdr_inline_decode(\u0026rctxt-\u003erc_stream,\n\u003e --\u003e 498 segcount * rpcrdma_segment_maxsz * sizeof(*p));\n\u003e\n\u003e\n\u003e segcount is an untrusted u32. On 32bit systems anything \u003e= SIZE_MAX / 16 will\n\u003e have an integer overflow and some those values will be accepted by\n\u003e xdr_inline_decode().",
"id": "GHSA-fcx4-qhgw-9q8f",
"modified": "2025-11-03T21:31:45Z",
"published": "2024-12-24T12:30:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53151"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/21e1cf688fb0397788c8dd42e1e0b08d58ac5c7b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/3c63d8946e578663b868cb9912dac616ea68bfd0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/4cbc3ba6dc2f746497cade60bcbaa82ae3696689"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/838dd342962cef4c320632a5af48d3c31f2f9877"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c1f8195bf68edd2cef0f18a4cead394075a54b5a"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e5c440c227ecdc721f2da0dd88b6358afd1031a7"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2025/03/msg00001.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.