Executive Summary

This vulnerability exists in the Linux kernel's io_uring subsystem, specifically in the handling of fixed buffer imports. The function validate_fixed_range() incorrectly allows a zero-length buffer at the exact end of a registered memory region due to a strict greater-than check. As a result, io_import_fixed() calculates an offset that causes it to read beyond the allocated bio_vec array, accessing out-of-bounds slab memory. This can lead to a slab-out-of-bounds read error.

The fix involves returning early from io_import_fixed() when the length of the buffer is zero, preventing any out-of-bounds memory access since a zero-length import should not process the bio_vec array.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause the Linux kernel to read memory outside the intended bounds, potentially leading to system instability or crashes due to slab-out-of-bounds errors. While the description does not explicitly mention exploitation scenarios, out-of-bounds reads can sometimes be leveraged to leak sensitive information or cause denial of service.

Useful 0 Not Useful 0