In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: fix u16 truncation of restart-area length check<\/p>\n
ntfs_check_restart_area() validates that the $LogFile restart area and
\nits trailing log client record array fit within the system page size:<\/p>\n
u16 ra_ofs, ra_len, ca_ofs;
\n …
\n ra_len = ca_ofs + le16_to_cpu(ra->log_clients) *
\n sizeof(struct log_client_record);
\n if (ra_ofs + ra_len > le32_to_cpu(rp->system_page_size) || …)
\n return false;<\/p>\n
ra_len is u16, but the right-hand side is computed in size_t
\n(sizeof(struct log_client_record) == 160). Both ca_ofs and log_clients
\ncome straight from the on-disk restart area. With an on-disk
\nlog_clients of 410 the product 410 * 160 = 65600; adding ca_ofs and
\nstoring into the u16 ra_len truncates modulo 65536 (e.g. ca_ofs 64
\ngives ra_len 128), so the “fits in the page” check passes even though
\nthe client array described by log_clients extends far beyond the page.<\/p>\n
ntfs_check_log_client_array() then walks the array bounded only by the
\non-disk log_clients count:<\/p>\n
cr = ca + idx;
\n if (cr->prev_client != LOGFILE_NO_CLIENT) …<\/p>\n
For log_clients 410 it dereferences records up to ca + 409 * 160,
\n~64 KiB past the kvzalloc(system_page_size) restart-page buffer — an
\nout-of-bounds read of attacker-controlled extent, reachable when a
\ncrafted NTFS image is mounted (load_and_check_logfile() at mount time).
\nThis is the in-kernel analogue of CVE-2022-30789, fixed in the ntfs-3g
\nuserspace driver but never in this revived classic driver.<\/p>\n
Compute the restart-area length in a u32 so the existing bounds check
\nrejects an over-large client array instead of being defeated by the
\ntruncation. Widen ra_ofs and ca_ofs to u32 as well: both are loaded
\nfrom __le16 on-disk fields and every comparison already promotes to
\nint\/size_t, so this changes no result and keeps the declaration uniform.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: fix u16 truncation of restart-area length check<\/p>\n
ntfs_check_restart_area() validates that the $LogFile restart area and
\nits t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12331","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12331","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12331"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12331"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12331"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}