In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: validate usa_ofs before preserving the update sequence number<\/p>\n
When ntfs_mft_record_alloc() reuses a free mft record it reads the old
\nupdate sequence number straight from the on-disk record:<\/p>\n
usn = *(__le16 *)((u8 *)m + le16_to_cpu(m->usa_ofs));<\/p>\n
Here m points into the raw $MFT page-cache folio, which still holds
\nunvalidated, MST-protected bytes: the folio is read by a plain
\niomap_read_folio() and neither post_read_mst_fixup() nor
\nntfs_mft_record_check() has run on it (both work on private copies).
\nm->usa_ofs is therefore an untrusted u16, and a corrupted record can put
\nit past the end of the record so the two-byte read lands outside the
\nfolio. Reading such a record while creating a file gives, under KASAN:<\/p>\n
BUG: KASAN: use-after-free in ntfs_mft_record_alloc+…
\n Read of size 2 at addr …
\n ntfs_mft_record_alloc -> __ntfs_create -> ntfs_create -> path_openat<\/p>\n
Only preserve the old update sequence number when usa_ofs is even and in
\nrange, mirroring the check ntfs_mft_record_check() already applies;
\notherwise leave usn zero, which the existing restore below skips.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: validate usa_ofs before preserving the update sequence number<\/p>\n
When ntfs_mft_record_alloc() reuses a free mft record it reads<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25526","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25526","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25526"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25526"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25526"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}