In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: fix off-by-one page overflow in ntfs_decompress()<\/p>\n
The per-token range check in ntfs_decompress() uses<\/p>\n
\tif (cb >= cb_sb_end || dp_addr > dp_sb_end)
\n\t\tbreak;<\/p>\n
so dp_addr == dp_sb_end falls through to the symbol copy
\n`*dp_addr++ = *cb++`, writing one byte past the destination page. Since
\nNTFS_SB_SIZE == PAGE_SIZE the destination is a single page, so the byte
\nlands in the adjacent page, and *dest_ofs is left one past the sub-block
\nend (the later `*dest_ofs &= ~PAGE_MASK` then yields 1, not 0, so the page
\nis never finalized and later sub-blocks keep writing further past it). A
\ncorrupted compressed $DATA attribute thus produces a bounded run of
\nout-of-bounds writes when the file is read.<\/p>\n
Break as soon as dp_addr reaches dp_sb_end; a full sub-block still
\ncompletes, as its final copy advances dp_addr to exactly dp_sb_end.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: fix off-by-one page overflow in ntfs_decompress()<\/p>\n
The per-token range check in ntfs_decompress() uses<\/p>\n
\tif (cb >= cb_sb_end <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25527","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25527","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25527"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25527"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25527"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}