In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix readdir position truncation on 32-bit kernels<\/p>\n
In ocfs2_dir_foreach_blk_el(), the directory cookie position is
\nrebuilt with<\/p>\n
\tctx->pos = (ctx->pos & ~(sb->s_blocksize – 1)) | offset;<\/p>\n
`ctx->pos` is loff_t (signed 64-bit), while `sb->s_blocksize` is
\nunsigned long. On 32-bit kernels unsigned long is 32-bit, so the mask<\/p>\n
\t~(sb->s_blocksize – 1)<\/p>\n
is computed as a 32-bit unsigned value (e.g. 0xfffff000 for a 4 KiB
\nblock size). In the AND expression with the 64-bit `ctx->pos`, that
\nunsigned operand is zero-extended to 64 bits per the usual arithmetic
\nconversions, yielding 0x00000000fffff000. The high 32 bits of
\n`ctx->pos` are silently cleared, even though directory size is
\nallowed to exceed 4 GiB.<\/p>\n
When readdir() crosses the 4 GiB boundary on a 32-bit kernel the
\nposition is reset back into the first 4 GiB block, making the
\nre-validation path re-enumerate already-returned dirents indefinitely.<\/p>\n
This is ocfs2_dir_foreach_blk_el(), the extent-list readdir path taken
\nfor all non-inline directories, so a directory large enough to cross
\n4 GiB reaches it.<\/p>\n
This is the same class of bug that commit 3dce5bb82c97 (“exfat: Fix
\nbitwise operation having different size”) fixed in exfat, and the
\nfix mirrors the equivalent ext4 fix in this series. Cast the operand
\nto loff_t so the mask is 64-bit before the AND:<\/p>\n
\tctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize – 1)) | offset;<\/p>\n
64-bit kernels are unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix readdir position truncation on 32-bit kernels<\/p>\n
In ocfs2_dir_foreach_blk_el(), the directory cookie position is
\nrebuilt w<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21412","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21412","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21412"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21412"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21412"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}