CVE-2023-52618

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

block/rnbd-srv: Check for unlikely string overflow

Since "dev_search_path" can technically be as large as PATH_MAX,

there was a risk of truncation when copying it and a second string

into "full_path" since it was also PATH_MAX sized. The W=1 builds were

reporting this warning:

drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra':

drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=]

616 | snprintf(full_path, PATH_MAX, "%s/%s",

| ^~

In function 'rnbd_srv_get_full_path',

inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096

616 | snprintf(full_path, PA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References