On Sun, 2026-08-23 at 23:30 -0500, Junjie Cao wrote: > The CVE describes an out-of-bounds read in the SMC protocol stack, but > the originating report, Red Hat bug 2040604, was never made public and > no tracker records affected code or a fix. > > On request, Red Hat PSIRT identified the affected code (ticket > PSIRTSUPT-22046, summarized in the public bug [1]): the v2_ext_offset > field of an incoming CLC proposal message is used to compute a memory > offset without validation, in the chain smc_clc_msg_hdr_valid() -> > smc_clc_msg_prop_valid() -> smc_get_clc_v2_ext() (net/smc/smc_clc.h). > > The unchecked read dates from the introduction of V2 CLC proposal > parsing in v5.10 (8c3dca341aea); at the time of the report, > smc_get_clc_v2_ext() checked the offset only for zero and > smc_clc_msg_prop_valid() dereferenced the resulting pointer. It is > closed by the v6.13 validation of exactly these fields: > > https://git.kernel.org/linus/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf > ("net/smc: check v2_ext_offset/eid_cnt/ism_gid_cnt when receiving > proposal msg", v6.13) > > The kernel CVE team assigned that commit CVE-2024-49568, recording the > issue introduced in 5.10 and fixed in 6.6.68, 6.12.7 and 6.13: > > > https://lore.kernel.org/linux-cve-announce/2025011142-CVE-2024-49568-e5f6@gregkh/ > > CVE-2022-0400 predates the kernel CNA and no tracker has connected it > to this fix. > > [1] https://bugzilla.redhat.com/show_bug.cgi?id=2044575#c23 > > CC: Paul Barker <[email protected]> > AI-Generated: Uses Claude (claude-opus-5) > Signed-off-by: Junjie Cao <[email protected]>
Thanks for following this up! One nitpick... > +# The originating report (Red Hat bug 2040604) is not public. On request, > +# Red Hat PSIRT identified the affected code: the v2_ext_offset of an > +# incoming SMC CLC proposal message was used without validation in > +# net/smc/smc_clc.h. Introduced in v5.10, fixed by the v6.13 proposal > +# message validation, which upstream tracks as CVE-2024-49568. > +# https://bugzilla.redhat.com/show_bug.cgi?id=2044575#c23 > +# Fix https://git.kernel.org/linus/7863c9f3d24ba49dbead7e03dfbe40deb5888fdf > +CVE_STATUS[CVE-2022-0400] = "fixed-version: Fixed from version 6.13" We can say 6.13rc4 here. Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#244073): https://lists.openembedded.org/g/openembedded-core/message/244073 Mute This Topic: https://lists.openembedded.org/mt/120897639/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
