In the Linux kernel through 3.2, the rds_message_alloc_sgs() function does not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c).
| Software | From | Fixed in |
|---|---|---|
| linux / linux_kernel | 3.19 | 4.1.50 |
| linux / linux_kernel | - | 3.2.99 |
| linux / linux_kernel | 3.3 | 3.16.54 |
| linux / linux_kernel | 3.17 | 3.18.92 |
| linux / linux_kernel | 4.2 | 4.4.112 |
| linux / linux_kernel | 4.5 | 4.9.77 |
| linux / linux_kernel | 4.10 | 4.14.44 |
| debian / debian_linux | 8.0 | 8.0.x |
| debian / debian_linux | 7.0 | 7.0.x |
| canonical / ubuntu_linux | 16.04 | 16.04.x |
| canonical / ubuntu_linux | 14.04 | 14.04.x |
| canonical / ubuntu_linux | 12.04 | 12.04.x |
| canonical / ubuntu_linux | 17.10 | 17.10.x |