qiurui/Centos-kernel-stream-10
1
0
Fork 0
mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git synced 2026-09-09 00:07:04 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge: xen: buffer overflow in drivers/xen/sys-hypervisor.c

Browse Source 
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2529

JIRA: https://redhat.atlassian.net/browse/RHEL-172518
CVE: CVE-2026-31786

Fix a buffer overflow in drivers/xen/sys-hypervisor.c (XSA-485 / CVE-2026-31786)

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>

Approved-by: Ani Sinha <anisinha@redhat.com>
Approved-by: simsingh <simsingh@redhat.com>
Approved-by: Maxim Levitsky <mlevitsk@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>

Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
This commit is contained in:
CKI KWF Bot
2026-08-20 09:14:38 +00:00
parent 7bb035c5df 94b14f5814
commit 1dfd1381f8
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/xen/sys-hypervisor.c
+6 -2
View File
@@ -366,6 +366,8 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer)
ret = sprintf(buffer, "<denied>");
return ret;
}
if (ret > PAGE_SIZE)
return -ENOSPC;
buildid = kmalloc(sizeof(*buildid) + ret, GFP_KERNEL);
if (!buildid)
@@ -373,8 +375,10 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer)
buildid->len = ret;
ret = HYPERVISOR_xen_version(XENVER_build_id, buildid);
if (ret > 0)
ret = sprintf(buffer, "%s", buildid->buf);
if (ret > 0) {
/* Build id is binary, not a string. */
memcpy(buffer, buildid->buf, ret);
}
kfree(buildid);
return ret;