In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: validate ef->size covers the record’s name and value<\/p>\n
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks
\nthat the record fits in the remaining buffer (ea_size > bytes), not that
\nef->size is large enough to hold the record’s own name_len + 1 + elength.<\/p>\n
A crafted image can pass validation with, e.g., ef->size = 24 but
\nelength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of
\nthe undersized record, reading past the kmalloc(info->size) allocation
\nand leaking heap memory to userspace via getxattr():<\/p>\n
BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs\/ntfs3\/xattr.c:302)
\n Read of size 65535 at addr ffff888100794550 by task exploit
\n __asan_memcpy (mm\/kasan\/shadow.c:105)
\n ntfs_get_ea (fs\/ntfs3\/xattr.c:302)
\n ntfs_getxattr (fs\/ntfs3\/xattr.c:848)
\n __vfs_getxattr (fs\/xattr.c:441)
\n vfs_getxattr (fs\/xattr.c:474)
\n do_getxattr (fs\/xattr.c:800)
\n path_getxattrat (fs\/xattr.c:868)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:94)<\/p>\n
The buggy address is located 80 bytes inside of
\n allocated 84-byte region in cache kmalloc-96<\/p>\n
Compute the size the record needs and require ef->size to cover it.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: validate ef->size covers the record’s name and value<\/p>\n
When an EA record has a non-zero ef->size, ntfs_read_ea() only chec<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24436","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24436","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24436"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24436"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24436"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}