In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes<\/p>\n
When the flexible_inline_xattr feature is enabled, do_read_inode() loads
\nthe on-disk i_inline_xattr_size unconditionally:<\/p>\n
\tif (f2fs_sb_has_flexible_inline_xattr(sbi))
\n\t\tfi->i_inline_xattr_size = le16_to_cpu(ri->i_inline_xattr_size);<\/p>\n
but sanity_check_inode() only range-checks it when the inode also has the
\nFI_INLINE_XATTR flag set. An inode that carries an inline dentry or inline
\ndata but not FI_INLINE_XATTR — the normal layout for an inline
\ndirectory — therefore keeps a fully attacker-controlled
\ni_inline_xattr_size from a crafted image.<\/p>\n
get_inline_xattr_addrs() returns that value with no flag gating, so it
\nfeeds the inode geometry:<\/p>\n
\tMAX_INLINE_DATA() = 4 * (CUR_ADDRS_PER_INODE – i_inline_xattr_size – 1)
\n\tNR_INLINE_DENTRY() = MAX_INLINE_DATA() * BITS_PER_BYTE \/ (…)
\n\taddrs_per_page() = CUR_ADDRS_PER_INODE – i_inline_xattr_size<\/p>\n
A large i_inline_xattr_size drives MAX_INLINE_DATA() and NR_INLINE_DENTRY()
\nnegative, so make_dentry_ptr_inline() sets d->max (int) to a negative
\nvalue. The inline directory walk then compares an unsigned long bit_pos
\nagainst that negative d->max, which is promoted to a huge unsigned bound,
\nand reads far past the inline area:<\/p>\n
\twhile (bit_pos max)\t\t\/* fs\/f2fs\/dir.c *\/
\n\t\t… test_bit_le(bit_pos, d->bitmap) \/ d->dentry[bit_pos] …<\/p>\n
Mounting a crafted image and reading such a directory triggers an
\nout-of-bounds read in f2fs_fill_dentries(); the same underflow also
\ncorrupts ADDRS_PER_INODE for regular files.<\/p>\n
Validate i_inline_xattr_size against MAX_INLINE_XATTR_SIZE whenever the
\nflexible_inline_xattr feature is enabled — i.e. whenever the value is
\nloaded from disk and consumed — and keep the lower MIN_INLINE_XATTR_SIZE
\nbound gated on inodes that actually carry an inline xattr, so legitimate
\ninodes with i_inline_xattr_size == 0 are still accepted.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
f2fs: bound i_inline_xattr_size for non-inline-xattr inodes<\/p>\n
When the flexible_inline_xattr feature is enabled, do_read_inode() loa<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14890","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}