In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hfsplus: Add a sanity check for btree node size<\/p>\n
Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image,
\nduring the file system mounting process, specifically while loading the
\ncatalog, a corrupted node_size value of 1 caused the rec_off argument
\npassed to hfs_bnode_read_u16() (within hfs_bnode_find()) to be excessively
\nlarge. Consequently, the function failed to return a valid value to
\ninitialize the off variable, triggering the bug [1].<\/p>\n
Every node starts from BTree node descriptor: struct hfs_bnode_desc.
\nSo, the size of node cannot be lesser than that. However, technical
\nspecification declares that: “The node size (which is expressed in bytes)
\nmust be power of two, from 512 through 32,768, inclusive.” Add a check
\nfor btree node size base on technical specification.<\/p>\n
[1]
\nBUG: KMSAN: uninit-value in hfsplus_bnode_find+0x141c\/0x1600 fs\/hfsplus\/bnode.c:584
\n hfsplus_bnode_find+0x141c\/0x1600 fs\/hfsplus\/bnode.c:584
\n hfsplus_btree_open+0x169a\/0x1e40 fs\/hfsplus\/btree.c:382
\n hfsplus_fill_super+0x111f\/0x2770 fs\/hfsplus\/super.c:553
\n get_tree_bdev_flags+0x6e6\/0x920 fs\/super.c:1694
\n get_tree_bdev+0x38\/0x50 fs\/super.c:1717
\n hfsplus_get_tree+0x35\/0x40 fs\/hfsplus\/super.c:709
\n vfs_get_tree+0xb3\/0x5d0 fs\/super.c:1754
\n fc_mount fs\/namespace.c:1193 [inline]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hfsplus: Add a sanity check for btree node size<\/p>\n
Syzbot reported an uninit-value bug in [1] with a corrupted HFS+ image,
\nduring the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12322","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12322","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12322"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12322"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12322"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}