CVE-2023-53778

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

accel/qaic: Clean up integer overflow checking in map_user_pages()

The encode_dma() function has some validation on in_trans->size but it

would be more clear to move those checks to find_and_map_user_pages().

The encode_dma() had two checks:

if (in_trans->addr + in_trans->size < in_trans->addr || !in_trans->size)

return -EINVAL;

The in_trans->addr variable is the starting address. The in_trans->size

variable is the total size of the transfer. The transfer can occur in

parts and the resources->xferred_dma_size tracks how many bytes we have

already transferred.

This patch introduces a new variable "remaining" which represents the

amount we want to transfer (in_trans->size) minus the amount we have

already transferred (resources->xferred_dma_size).

I have modified the check for if in_trans->size is zero to instead check

if in_trans->size is less than resources->xferred_dma_size. If we have

already transferred

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References