On 7/8/26 3:21 AM, Thiébaud Weksteen wrote: > In elf_validity_cache_sechdrs, section sizes and offsets are validated, > unless the section type is SHT_NULL or SHT_NOBITS. > > Later, elf_validity_cache_secstrings and elf_validity_cache_index_str > access the section name table (.shstrtab) and symbol string table > (.strtab) headers without first ensuring that their types are > SHT_STRTAB. If a section type is SHT_NULL or SHT_NOBITS, sh_offset has > not been validated and may reference out-of-bounds memory when > dereferenced in elf_validity_cache_secstrings or > elf_validity_cache_strtab. > > Validate that both string section headers are of type SHT_STRTAB before > caching them. > > Signed-off-by: Thiébaud Weksteen <[email protected]>
I've queued the patch on modules-next for v7.3-rc1. -- Thanks, Petr
