CVE-2024-42136

cdrom: rearrange last_media_change check to avoid unintentional overflow

published July 30, 2024

CVSS
—
EPSS
0%
Percentile
13.5
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

cdrom: rearrange last_media_change check to avoid unintentional overflow

When running syzkaller with the newly reintroduced signed integer wrap

sanitizer we encounter this splat:

[ 366.015950] UBSAN: signed-integer-overflow in ../drivers/cdrom/cdrom.c:2361:33

[ 366.021089] -9223372036854775808 - 346321 cannot be represented in type '__s64' (aka 'long long')

[ 366.025894] program syz-executor.4 is using a deprecated SCSI ioctl, please convert it to SG_IO

[ 366.027502] CPU: 5 PID: 28472 Comm: syz-executor.7 Not tainted 6.8.0-rc2-00035-gb3ef86b5a957 #1

[ 366.027512] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

[ 366.027518] Call Trace:

[ 366.027523] <TASK>

[ 366.027533] dump_stack_lvl+0x93/0xd0

[ 366.027899] handle_overflow+0x171/0x1b0

[ 366.038787] ata1.00: invalid multi_count 32 ignored

[ 366.043924] cdrom_ioctl+0x2c3f/0x2d10

[ 366.063932] ? __pm_runtime_resume+0xe6/0x130

[ 366.071923] sr_block_ioctl+0x15d/0x1d0

[ 366.074624] ? __pfx_sr_block_ioctl+0x10/0x10

[ 366.077642] blkdev_ioctl+0x419/0x500

[ 366.080231] ? __pfx_blkdev_ioctl+0x10/0x10

...

Historically, the signed integer overflow sanitizer did not work in the

kernel due to its interaction with `-fwrapv` but this has since been

changed [1] in the newest version of Clang. It was re-enabled in the

kernel with Commit 557f8c582a9ba8ab ("ubsan: Reintroduce signed overflow

sanitizer").

Let's rearrange the check to not perform any arithmetic, thus not

tripping the sanitizer.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00234 · 13.5th percentile
Published
2024-07-30T07:46Z
EPSS history
Timeline
  • 30 JUL 07:46Z
    cdrom: rearrange last_media_change check to avoid unintentional overflow
    cvelistv5