In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse\/objid init<\/p>\n
ntfs_reparse_init() and ntfs_objid_init() parse the index root of the
\n$Extend\/$Reparse and $Extend\/$ObjId metafiles (the INDEX_ROOT attributes
\nnamed $R and $O). They read its type and rule fields through
\nresident_data(), which does not check that the resident attribute is
\nlarge enough to hold them.<\/p>\n
mi_enum_attr() accepts a resident attribute with data_off == asize and
\ndata_size == 0. For such an attribute placed last in its MFT record,
\nresident_data() returns a pointer to the end of the record_size buffer,
\nso reading root->type \/ root->rule reads past the allocation.<\/p>\n
Use resident_data_ex(attr, sizeof(struct INDEX_ROOT)) and bail out when
\nit returns NULL, as ntfs_security_init() already does for $SDH \/ $SII.<\/p>\n
The attribute is only parsed while mounting a crafted image, so this
\nneeds CAP_SYS_ADMIN.<\/p>\n
BUG: KASAN: slab-out-of-bounds in ntfs_reparse_init (fs\/ntfs3\/fsntfs.c:2306)
\n Read of size 4 at addr ffff88801219dc00 by task mount
\n ntfs_reparse_init (fs\/ntfs3\/fsntfs.c:2306)
\n ntfs_fill_super (fs\/ntfs3\/super.c:1604)
\n get_tree_bdev_flags (fs\/super.c:1703)
\n vfs_get_tree (fs\/super.c:1758)
\n path_mount (fs\/namespace.c:4131)
\n __x64_sys_mount (fs\/namespace.c:4360)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix out-of-bounds read of INDEX_ROOT in reparse\/objid init<\/p>\n
ntfs_reparse_init() and ntfs_objid_init() parse the index roo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24442","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24442","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24442"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24442"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24442"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}