Linux Kernel Ring Buffer Slab-Out-Of-Bounds Vulnerability Allowing Memory Corruption

A vulnerability in the Linux kernel's handling of the ring buffer can lead to a slab-out-of-bounds memory access, causing memory corruption. This issue arises from an overflow in the calculation of the number of pages, which fails to account for certain conditions, allowing for improper memory access. The vulnerability has been reported in version 6.13.0-rc2.

Impact

Exploitation of this vulnerability leads to a slab-out-of-bounds memory access, causing memory corruption.

Reproduction

The vulnerability can be reproduced by writing a value to the 'buffer_size_kb' file in the tracing subsystem, then opening the 'trace_pipe_raw' file for reading. After that, the 'mmap' system call can be used to map a region of memory, which triggers the overflow and the subsequent out-of-bounds access.