CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's `qrtr_endpoint_post()` function, specifically in 32-bit systems where an integer overflow can occur due to improper validation of incoming packet sizes. This flaw allows for potential kernel crashes by writing past the allocated buffer, leading to system instability. System administrators and developers using 32-bit Linux environments should prioritize applying the fix to mitigate the risk of kernel panics and ensure system reliability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix 32-bit integer overflow in qrtr_endpoint_post() qrtr_endpoint_post() validates an incoming packet with if (!size || len != ALIGN(size, 4) + hdrlen) goto err; where size comes from the wire. On 32-bit, size_t is 32 bits and ALIGN(size, 4) wraps to 0 for size >= 0xfffffffd, so the check passes and skb_put_data(skb, data + hdrlen, size) writes past the hdrlen-sized skb and oopses the kernel. 64-bit is unaffected. This is the 32-bit residual of ad9d24c9429e2 ("net: qrtr: fix OOB Read in qrtr_endpoint_post"), which fixed only the 64-bit case. Reject any size that cannot fit the buffer before the ALIGN.