libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
authorziming zhang <ezrakiez@gmail.com>
Fri, 14 Nov 2025 08:56:10 +0000 (16:56 +0800)
committerIlya Dryomov <idryomov@gmail.com>
Thu, 27 Nov 2025 08:59:49 +0000 (09:59 +0100)
commit7fce830ecd0a0256590ee37eb65a39cbad3d64fc
tree96a79030a9b57fa32d344072ff49fe77e1b82d6c
parentec3797f043756a94ea2d0f106022e14ac4946c02
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()

The len field originates from untrusted network packets. Boundary
checks have been added to prevent potential out-of-bounds writes when
decrypting the connection secret or processing service tickets.

[ idryomov: changelog ]

Cc: stable@vger.kernel.org
Signed-off-by: ziming zhang <ezrakiez@gmail.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
net/ceph/auth_x.c