VMware Photon OS: CVE-2024-57890

VMware Photon OS: CVE-2024-57890

Severity

5

CVSS

(AV:L/AC:L/Au:S/C:N/I:N/A:C)

Published

01/15/2025

Created

01/30/2025

Added

01/29/2025

Modified

02/04/2025

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Prevent integer overflow issue In the expression "cmd.wqe_size * cmd.wr_count", both variables are u32 values that come from the user so the multiplication can lead to integer wrapping.Then we pass the result to uverbs_request_next_ptr() which also could potentially wrap.The "cmd.sge_count * sizeof(struct ib_uverbs_sge)" multiplication can also overflow on 32bit systems although it's fine on 64bit systems. This patch does two things.First, I've re-arranged the condition in uverbs_request_next_ptr() so that the use controlled variable "len" is on one side of the comparison by itself without any math.Then I've modified all the callers to use size_mul() for the multiplications.

Solution(s)

• vmware-photon_os_update_tdnf

References

• https://attackerkb.com/topics/cve-2024-57890
• CVE - 2024-57890