Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]libceph: fix invalid accesses to ceph_connection_v1_info[EOL][EOL]There is a place where generic code in messenger.c is reading and[EOL]another place where it is writing to con->v1 union member without[EOL]checking that the union member is active (i.e. msgr1 is in use).[EOL][EOL]On 64-bit systems, con->v1.auth_retry overlaps with con->v2.out_iter,[EOL]so such a read is almost guaranteed to return a bogus value instead of[EOL]0 when msgr2 is in use.  This ends up being fairly benign because the[EOL]side effect is just the invalidation of the authorizer and successive[EOL]fetching of new tickets.[EOL][EOL]con->v1.connect_seq overlaps with con->v2.conn_bufs and the fact that[EOL]it's being written to can cause more serious consequences, but luckily[EOL]it's not something that happens often.