In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()<\/p>\n
ni_read_frame() decompresses an LZNT $DATA frame into the vmapped target
\npages and then trusts decompress_lznt()’s return value:<\/p>\n
unc_size = decompress_lznt(frame_ondisk, ondisk_size, frame_mem,
\n frame_size);
\n if ((ssize_t)unc_size frame_size) err = -EINVAL;<\/p>\n
decompress_lznt() stops as soon as the compressed stream is exhausted
\n(e.g. a zero chunk header) and returns the number of bytes it actually
\nwrote, which may be far less than frame_size. The bytes between unc_size
\nand frame_size are never written. The only memset() that follows zeroes
\nthe region beyond i_valid; when the frame lies entirely within the file’s
\nvalid size that memset() does not run, so the gap retains whatever was in
\nthe just-vmapped pages. All pages are then marked uptodate and returned
\nto userspace, disclosing uninitialized (recently-freed) kernel page
\nmemory. A crafted compressed file whose stream decompresses to only a few
\nbytes leaks the remainder of every frame on a plain read(2), which is
\nenough to recover kernel pointers and defeat KASLR.<\/p>\n
Zero the [unc_size, frame_size) tail immediately after a successful LZNT
\ndecompress so the remainder reads back as zero.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix info-leak on partial LZNT decompress in ni_read_frame()<\/p>\n
ni_read_frame() decompresses an LZNT $DATA frame into the vm<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21538","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21538","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}