In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: reject restart table growth beyond U16_MAX entries<\/p>\n
During $LogFile replay, log_replay() indexes the transaction table by the
\ntransact_id taken from the log record header. check_log_rec() only
\nverifies that transact_id is non-zero and properly aligned, not its
\nmagnitude, so a crafted image can request an arbitrarily large index.<\/p>\n
alloc_rsttbl_from_idx() grows the table to cover that index via
\nextend_rsttbl(), which passes the new entry count to init_rsttbl():<\/p>\n
\trt = init_rsttbl(esize, used + add);<\/p>\n
used + add is computed as u32 but init_rsttbl() takes a u16, and the
\ncount is stored in struct RESTART_TABLE as a __le16. When used + add
\nexceeds U16_MAX it is truncated, init_rsttbl() allocates a table far
\nsmaller than the index requires, and alloc_rsttbl_from_idx() then
\ndereferences and writes at the original, untruncated offset — an
\nout-of-bounds access past the allocation, reachable by mounting a
\ncrafted NTFS image.<\/p>\n
BUG: KASAN: use-after-free in alloc_rsttbl_from_idx (fs\/ntfs3\/fslog.c:950)
\n Read of size 4 at addr ffff8880327ffff8 by task exploit
\n alloc_rsttbl_from_idx (fs\/ntfs3\/fslog.c:950)
\n log_replay (fs\/ntfs3\/fslog.c:4562)
\n ntfs_loadlog_and_replay (fs\/ntfs3\/fsntfs.c:324)
\n ntfs_fill_super (fs\/ntfs3\/super.c:1393)
\n get_tree_bdev_flags
\n vfs_get_tree
\n path_mount
\n __x64_sys_mount<\/p>\n
A restart table is limited to U16_MAX entries by its __le16 count, so a
\nlarger growth request is invalid input. Reject it in extend_rsttbl();
\nall callers already handle a NULL return.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: reject restart table growth beyond U16_MAX entries<\/p>\n
During $LogFile replay, log_replay() indexes the transaction table by<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24439","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24439","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24439"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24439"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24439"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}