Centos-kernel-stream-9

mirror of https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9.git synced 2026-09-09 00:08:12 +08:00

Files

T

Vitaly Kuznetsov d3734a66e9 Buffer overflow in drivers/xen/sys-hypervisor.c

JIRA: https://redhat.atlassian.net/browse/RHEL-172511
CVE: CVE-2026-31786

commit 27fdbab4221b375de54bf91919798d88520c6e28
Author: Juergen Gross <jgross@suse.com>
Date:   Fri Mar 27 14:13:38 2026 +0100

    Buffer overflow in drivers/xen/sys-hypervisor.c

    The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is
    neither NUL terminated nor a string.

    The first causes a buffer overflow as sprintf in buildid_show will
    read and copy till it finds a NUL.

    00000000  f4 91 51 f4 dd 38 9e 9d  65 47 52 eb 10 71 db 50  |..Q..8..eGR..q.P|
    00000010  b9 a8 01 42 6f 2e 32                              |...Bo.2|
    00000017

    So use a memcpy instead of sprintf to have the correct value:

    00000000  f4 91 51 f4 dd 00 9e 9d  65 47 52 eb 10 71 db 50  |..Q.....eGR..q.P|
    00000010  b9 a8 01 42                                       |...B|
    00000014

    (the above have a hack to embed a zero inside and check it's
    returned correctly).

    This is XSA-485 / CVE-2026-31786

    Fixes: 84b7625728 ("xen: add sysfs node for hypervisor build id")
    Signed-off-by: Frediano Ziglio <frediano.ziglio@citrix.com>
    Reviewed-by: Juergen Gross <jgross@suse.com>
    Signed-off-by: Juergen Gross <jgross@suse.com>

Signed-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>

2026-08-26 15:35:19 +02:00

accel

…

accessibility

…

acpi

…

amba

…

android

…

ata