From: Bart Van Assche <bvanassche@acm.org>
To: jackysliu <1972843537@qq.com>
Cc: James.Bottomley@HansenPartnership.com,
linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
martin.petersen@oracle.com
Subject: Re: [PATCH v2] scsi: fix out of bounds error in /drivers/scsi
Date: Tue, 15 Jul 2025 06:00:00 -0700 [thread overview]
Message-ID: <bf166912-80ef-435e-885d-affce237afe7@acm.org> (raw)
In-Reply-To: <tencent_ADA5210D1317EEB6CD7F3DE9FE9DA4591D05@qq.com>
On 6/18/25 9:03 PM, jackysliu wrote:
> 6.15-stable review patch, vulnerability exists since v6.9
>
> Out-of-bounds vulnerability found in ./drivers/scsi/sd.c
> The vulnerability is found by is found by Wukong-Agent
> (formerly Tencent Woodpecker), a code security AI agent,
> through static code analysis.
>
> sd_read_block_limits_ext Function Due to Unreasonable boundary checks.
> Out-of-bounds read vulnerability exists in the
> Linux kernel's SCSI disk driver (./drivers/scsi/sd.c).
> The flaw occurs in the sd_read_block_limits_ext function
> when processing Vital Product Data (VPD) page B7 (Block Limits Extension)
> responses from storage devices
>
> A maliciously crafted 4-byte VPD page (0xB7) would cause Out-of-Bounds
> Memory Read, leading to potential system Instability
> and Driver State Corruption.
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
next prev parent reply other threads:[~2025-07-15 13:00 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-06-17 9:03 [PATCH] scsi: fix out of bounds error in /drivers/scsi jackysliu
2025-06-17 20:44 ` Bart Van Assche
2025-06-18 6:31 ` jackysliu
2025-06-18 15:26 ` [PATCH] " Bart Van Assche
2025-06-30 8:21 ` jackysliu
2025-06-19 4:03 ` [PATCH v2] " jackysliu
2025-07-15 7:56 ` [PATCH v2] usb: gadget: functioni: Fix a oob problem in rndis jackysliu
2025-07-15 13:00 ` Bart Van Assche [this message]
2025-07-15 15:36 ` [PATCH v2] scsi: fix out of bounds error in /drivers/scsi Krzysztof Kozlowski
2025-07-15 16:57 ` Bart Van Assche
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bf166912-80ef-435e-885d-affce237afe7@acm.org \
--to=bvanassche@acm.org \
--cc=1972843537@qq.com \
--cc=James.Bottomley@HansenPartnership.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-scsi@vger.kernel.org \
--cc=martin.petersen@oracle.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.