In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix out-of-bounds read in read_log_rec_buf()<\/p>\n
read_log_rec_buf() copies a log record into a caller buffer starting at<\/p>\n
\tu32 off = lsn_to_page_off(log, lsn) + log->record_header_len;<\/p>\n
log->record_header_len (and log->data_off, used for the following pages)
\ncomes verbatim from the on-disk restart area and is only checked for
\n8-byte alignment in is_rst_area_valid(), so off can exceed
\nlog->page_size. “tail = log->page_size – off” then underflows and
\nmemcpy() reads past the page_size-sized buffer returned by
\nread_log_page(), spilling adjacent slab memory into the replay buffer.<\/p>\n
This is reachable by mounting a crafted NTFS image:<\/p>\n
BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216\/0x580
\n Read of size 64 at addr ffff88800a877ff8 by task exploit\/127
\n read_log_rec_buf fs\/ntfs3\/fslog.c:2299
\n log_replay fs\/ntfs3\/fslog.c:4216
\n ntfs_loadlog_and_replay fs\/ntfs3\/fsntfs.c:324
\n ntfs_fill_super fs\/ntfs3\/super.c:1392
\n get_tree_bdev_flags fs\/super.c:1694
\n __x64_sys_mount fs\/namespace.c:4360
\n The buggy address is located 4088 bytes to the right of
\n the 4096-byte region [ffff88800a876000, ffff88800a877000)<\/p>\n
Reject an in-page offset outside the current page before the copy.<\/p>\n
[almaz.alexandrovich@paragon-software.com: replaced the >= sign with >]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix out-of-bounds read in read_log_rec_buf()<\/p>\n
read_log_rec_buf() copies a log record into a caller buffer starting at<\/p>\n
\tu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24438","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24438","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}