In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: validate resident attribute lists and harden the validator<\/p>\n
A base inode’s $ATTRIBUTE_LIST is sanity-checked by load_attribute_list()
\nonly on the non-resident path; ntfs_read_locked_inode() copies a *resident*
\nattribute list into ni->attr_list with a plain memcpy() and no validation
\nat all. Every subsequent walk of ni->attr_list —
\nntfs_external_attr_find(), ntfs_inode_attach_all_extents() and
\nntfs_attrlist_need() — then trusts the entries are well-formed and reads
\nattr_list_entry fixed-header fields
\n(lowest_vcn at offset 8, mft_reference at offset 16, and the name) with
\nbounds that assume validation already happened. A crafted resident
\nattribute list therefore reaches those walks unvalidated and can drive
\nout-of-bounds reads of the attribute-list buffer.<\/p>\n
load_attribute_list() itself reads ale->name_offset (offset 7),
\nale->mft_reference (offset 16) and the name length under only an
\n“al length is a multiple of 8 covering the fixed header plus the
\nname, and that the entry is in use and carries a live MFT reference.
\nntfs_attr_list_is_valid() walks the buffer with it and checks the entries
\ntile it exactly. Use the list validator in load_attribute_list()
\n(replacing the open-coded loop, closing its own over-read) and on the
\nresident path in ntfs_read_locked_inode() (which previously skipped
\nvalidation entirely); patches 2\/3 reuse the per-entry helper at the other
\ntwo attribute-list walks.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: validate resident attribute lists and harden the validator<\/p>\n
A base inode’s $ATTRIBUTE_LIST is sanity-checked by load_attribut<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-12333","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/12333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=12333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=12333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=12333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}