CVE-2024-53151: svcrdma: Address an integer overflow

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-12-24 · updated 2026-08-04
Weakness: CWE-190

Description

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Address an integer overflow Dan Carpenter reports: > Commit 78147ca8b4a9 ("svcrdma: Add a "parsed chunk list" data > structure") from Jun 22, 2020 (linux-next), leads to the following > Smatch static checker warning: > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c:498 xdr_check_write_chunk() > warn: potential user controlled sizeof overflow 'segcount * 4 * 4' > > net/sunrpc/xprtrdma/svc_rdma_recvfrom.c > 488 static bool xdr_check_write_chunk(struct svc_rdma_recv_ctxt *rctxt) > 489 { > 490 u32 segcount; > 491 __be32 *p; > 492 > 493 if (xdr_stream_decode_u32(&rctxt->rc_stream, &segcount)) > ^^^^^^^^ > > 494 return false; > 495 > 496 /* A bogus segcount causes this buffer overflow check to fail. */ > 497 p = xdr_inline_decode(&rctxt->rc_stream, > --> 498 segcount * rpcrdma_segment_maxsz * sizeof(*p)); > > > segcount is an untrusted u32. On 32bit systems anything >= SIZE_MAX / 16 will > have an integer overflow and some those values will be accepted by > xdr_inline_decode().

Affected products

Linux kernel: from 5.11 before 5.15.174; from 5.16 before 6.1.120; from 6.2 before 6.6.64; from 6.7 before 6.11.11; from 6.12 before 6.12.2 — fixed in 5.15.174, 6.1.120, 6.11.11, 6.12.2, 6.6.64

How to fix

Upgrade to a fixed version: Linux kernel 5.15.174, 6.1.120, 6.11.11, 6.12.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-53151 or the next vulnerability affects your stack