CVE-2023-54135

In the Linux kernel, the following vulnerability has been resolved:

maple_tree: fix potential out-of-bounds access in mas_wr_end_piv()

Check the write offset end bounds before using it as the offset into the pivot array. This avoids a possible out-of-bounds access on the pivot array if the write extends to the last slot in the node, in which case the node maximum should be used as the end pivot.

akpm: this doesn't affect any current callers, but new users of mapletree may encounter this problem if backported into earlier kernels, so let's fix it in -stable kernels in case of this.

A low impact out-of-bounds access was found in the Linux kernel's maple tree implementation (lib/maple_tree.c). In mas_wr_end_piv(), the write offset end was used as an index into the pivot array without first checking its bounds, which can cause an out-of-bounds access on the pivot array when a write extends to the last slot in a node; in that case the node maximum should be used as the end pivot. Red Hat rated this flaw Low impact (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because it requires local access and the expected impact is limited to kernel availability, whereas the upstream CVE.org record assigns a higher score (7.8) by assuming confidentiality and integrity impacts that Red Hat's assessment does not support. Upstream further noted that no current callers reach the problematic path; the issue only arises for new users of the maple tree or when the code is backported to earlier kernels, which limits practical exposure. The vulnerable code is not present in Red Hat Enterprise Linux 6, 7, 8, and 10 or in Red Hat In-Vehicle OS, so those products are not affected; only the Red Hat Enterprise Linux 9 kernel and kernel-rt contain the vulnerable code. The fix for the affected Red Hat Enterprise Linux 9 streams is deferred given the low practical impact of this flaw, leaving a residual risk that a local user could trigger the out-of-bounds access in the maple tree code and crash the kernel (denial of service) if a code path exercising the flawed bounds handling is reached.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.