Executive Summary

This vulnerability exists in the Linux kernel's SCSI target core, specifically in the sbc_execute_unmap() function. The function checks that the Logical Block Addressing (LBA) plus the range does not exceed the device capacity. However, it does not properly guard against an integer overflow when adding LBA and range on 64-bit systems, which can cause the sum to wrap around and bypass the bounds check.

The issue was fixed by adding an overflow check similar to the one already used for the WRITE_SAME command in the same file.

Useful 0 Not Useful 0

Impact Analysis

An integer overflow in the bounds check could allow an attacker or a malicious process to specify an LBA and range that bypasses the intended device capacity checks. This could potentially lead to out-of-bounds memory access or data corruption on the device, impacting system stability or data integrity.

Useful 0 Not Useful 0