In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfs: fix off-by-one in rtrefcount btree root level validation<\/p>\n
xfs_rtrefcountbt_compute_maxlevels() sets<\/p>\n
\tmp->m_rtrefc_maxlevels = min(d_maxlevels, r_maxlevels) + 1;<\/p>\n
where the trailing “+ 1″ already accounts for the inode-root level, so the
\ndeepest valid on-disk root level is m_rtrefc_maxlevels – 1 and a cursor must
\nsatisfy bc_nlevels ” instead of “>=”, so a
\ncrafted rtreflink (metadir + realtime + reflink) image whose
\n\/rtgroups\/N.refcount inode has bb_level == m_rtrefc_maxlevels is accepted on
\nmount. xfs_rtrefcountbt_init_cursor() then sets bc_nlevels = bb_level + 1,
\nexceeding bc_maxlevels by one. Since the xfs_rtrefcountbt_cur slab object is
\nsized for exactly bc_maxlevels entries, the first btree op on such a cursor
\nindexes bc_levels[m_rtrefc_maxlevels] past the end of the object. This is
\nreached by the first rtrefcount cursor built after mount, via log\/CoW
\nrecovery (xfs_reflink_recover_cow() during xfs_mountfs()) or an
\nFS_IOC_GETFSMAP over the realtime device.<\/p>\n
Reject a root level equal to m_rtrefc_maxlevels, matching the “>=” form
\nalready used by the sibling data-device refcount\/rmap verifiers and the
\nin-memory rtrmap verifier.<\/p>\n
BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup (fs\/xfs\/libxfs\/xfs_btree.c:2101)
\n Write of size 2 at addr ffff888018391658 by task exploit\/144
\n xfs_btree_lookup (fs\/xfs\/libxfs\/xfs_btree.c:2101)
\n xfs_btree_query_range (fs\/xfs\/libxfs\/xfs_btree.c:5308)
\n xfs_refcount_recover_cow_leftovers (fs\/xfs\/libxfs\/xfs_refcount.c:2113)
\n xfs_reflink_recover_cow (fs\/xfs\/xfs_reflink.c:1085)
\n xlog_recover_finish (fs\/xfs\/xfs_log_recover.c:3551)
\n xfs_mountfs (fs\/xfs\/xfs_mount.c:1158)
\n xfs_fs_fill_super (fs\/xfs\/xfs_super.c:1940)
\n get_tree_bdev_flags (fs\/super.c:1634)
\n vfs_get_tree (fs\/super.c:1694)
\n path_mount (fs\/namespace.c:4161)
\n __x64_sys_mount (fs\/namespace.c:4367)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)
\n The buggy address belongs to the cache xfs_rtrefcountbt_cur of size 216
\n The buggy address is located 8 bytes to the right of
\n allocated 216-byte region [ffff888018391578, ffff888018391650)
\n Kernel panic – not syncing: Fatal exception<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
xfs: fix off-by-one in rtrefcount btree root level validation<\/p>\n
xfs_rtrefcountbt_compute_maxlevels() sets<\/p>\n
\tmp->m_rtrefc_maxlevels =<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11945","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11945","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11945"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11945"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11945"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}