In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
isofs: validate Rock Ridge CE continuation extent against volume size<\/p>\n
rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE
\nrecord and passes it to sb_bread() without checking that the block
\nnumber is within the mounted ISO 9660 volume. commit e595447e177b
\n(“[PATCH] rock.c: handle corrupted directories”) added cont_offset
\nand cont_size rejection for the CE continuation but did not validate
\nthe extent block number itself. commit f54e18f1b831 (“isofs: Fix
\ninfinite looping over CE entries”) later capped the CE chain length
\nat RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked.<\/p>\n
With a crafted ISO mounted via udisks2 (desktop optical auto-mount)
\nor via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at
\nan out-of-range block or at blocks belonging to an adjacent
\nfilesystem on the same block device. sb_bread() on an out-of-range
\nblock returns NULL cleanly via the block layer EIO path, so there
\nis no memory-safety violation. For in-range reads of adjacent-
\nfilesystem data, the CE buffer is parsed as Rock Ridge records and
\nonly the text of SL sub-records reaches userspace through
\nreadlink(), which makes the info-leak channel narrow and difficult
\nto exploit; still, rejecting the malformed CE outright matches the
\nrejection shape already present in the same function for
\ncont_offset and cont_size.<\/p>\n
Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next
\nto the existing offset\/size rejection, printing the same
\ncorrupted-directory-entry notice.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
isofs: validate Rock Ridge CE continuation extent against volume size<\/p>\n
rock_continue() reads rs->cont_extent verbatim from the Rock<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-15998","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/15998","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=15998"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=15998"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=15998"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}