Bug 1214050 (CVE-2023-4205) - VUL-0: CVE-2023-4205: kernel-source-rt,kernel-source-azure,kernel-source: reiserfs: out of bounds write in do_journal_end()
Summary: VUL-0: CVE-2023-4205: kernel-source-rt,kernel-source-azure,kernel-source: rei...
Status: RESOLVED INVALID
Alias: CVE-2023-4205
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/374367/
Whiteboard: CVSSv3.1:SUSE:CVE-2023-4205:4.4:(AV:L...
Keywords:
Depends on:
Blocks:
 
Reported: 2023-08-08 05:21 UTC by Carlos López
Modified: 2023-08-11 09:13 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Carlos López 2023-08-08 05:21:29 UTC
CVE-2023-4205

A flaw in the Linux Kernel found. Out of bounds memory access can happen in do_journal_end function when fail array-index-out-of-bounds in fs/reiserfs/journal.c happens.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-4205
https://bugzilla.redhat.com/show_bug.cgi?id=2228101
https://www.cve.org/CVERecord?id=CVE-2023-4205
https://access.redhat.com/security/cve/CVE-2023-4205
https://www.spinics.net/lists/kernel/msg4876594.html
Comment 1 Carlos López 2023-08-08 05:23:12 UTC
It might be a false positive:
https://www.spinics.net/lists/reiserfs-devel/msg07351.html
Comment 3 Anthony Iliopoulos 2023-08-08 13:47:01 UTC
I'm not really familiar with the reiserfs codebase to comment on the viability of this being exploited, and I do not see any further upstream discussion yet. 

Perhaps Jan knows more about this.

We can certainly consider a backport if indeed upstream deems this is an issue that requires a fix and produces one.
Comment 4 Jan Kara 2023-08-09 15:41:50 UTC
OK, so I took some time to understand the code and the report seems completely bogus AFAICT. UBSAN is complaining about access that is perfectly fine (just incorrectly detected variable-length array) and the theory the guy has that maybe there could be more members on the list than there's space in the block is wrong as well because reiserfs actually does check the list has no more members than journal->j_trans_max when adding new members to the list. More details in [1]. So please dispute this CVE as invalid. Thanks!


[1] https://lore.kernel.org/all/20230809153207.zokdmoco4lwa5s6b@quack3
Comment 5 Jan Kara 2023-08-09 15:42:07 UTC
Reassigning back to security team.
Comment 6 Anthony Iliopoulos 2023-08-09 16:19:04 UTC
(In reply to Jan Kara from comment #4)
> OK, so I took some time to understand the code and the report seems
> completely bogus AFAICT. UBSAN is complaining about access that is perfectly
> fine (just incorrectly detected variable-length array) and the theory the
> guy has that maybe there could be more members on the list than there's
> space in the block is wrong as well because reiserfs actually does check the
> list has no more members than journal->j_trans_max when adding new members
> to the list. More details in [1]. So please dispute this CVE as invalid.
> Thanks!
> 
> 
> [1] https://lore.kernel.org/all/20230809153207.zokdmoco4lwa5s6b@quack3

Many thanks for handling this, Jan.

Seems like there is already more or less consensus on how to handle those in the discussion @research ml. I think from upstream perspective it is clear (basically unmaintained, scheduled for deprecation), and unless whoever submits those reports is also willing to submit fixes, it doesn't seem there will be any resources invested in doing so.

I suppose the same goes for SLES, given that we have been providing upgrade paths for a long time (and customers can still use btrfs-convert to move off reiserfs). I think we generally like to provide at least read-only support even to legacy filesystems (as long as it is reasonable), but I am assuming any non-trivial reiserfs work coming from upstream (such as this one) which requires resources will be handled as WONTFIX in the future, unless there is a very specific customer requirement that justifies the effort.