In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: lzo: reject compressed segment that overflows the compressed input<\/p>\n
lzo_decompress_bio() validates each on-disk segment length seg_len only
\nagainst the workspace cbuf size, not against the compressed input size
\n(compressed_len, the total folio bytes of the bio). A crafted extent can
\ncarry a segment whose seg_len passes the cbuf check but runs past the end
\nof the bio, so copy_compressed_segment() walks off the last folio:
\nget_current_folio() then returns the NULL folio from bio_next_folio(), and
\nwith CONFIG_BTRFS_ASSERT disabled (default) folio_size(NULL) faults.<\/p>\n
BUG: KASAN: null-ptr-deref in lzo_decompress_bio (fs\/btrfs\/lzo.c:383)
\n Read of size 8 at addr 0000000000000000 by task kworker\/u8:1\/29
\n Workqueue: btrfs-endio simple_end_io_work
\n kasan_report (mm\/kasan\/report.c:590)
\n lzo_decompress_bio (fs\/btrfs\/lzo.c:383)
\n end_bbio_compressed_read (fs\/btrfs\/compression.c:1065)
\n btrfs_bio_end_io (fs\/btrfs\/bio.c:135)
\n btrfs_check_read_bio (fs\/btrfs\/bio.c:180 fs\/btrfs\/bio.c:285)
\n simple_end_io_work
\n process_one_work
\n worker_thread<\/p>\n
Reject any segment whose payload would extend beyond compressed_len before
\ncopying it, treating it as corruption like the other on-disk validation
\nfailures in this function.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
btrfs: lzo: reject compressed segment that overflows the compressed input<\/p>\n
lzo_decompress_bio() validates each on-disk segment leng<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12312","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}