In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()<\/p>\n
ntfs_ir_to_ib copies all entries from index_root into a freshly allocated
\nindex_block_size-byte buffer without verifying that the entries fit in the
\navailable space. The entries in index_root may be larger than the usable
\nentry space in the index block.<\/p>\n
This can cause OOB writes past the end of the allocation.<\/p>\n
The validator ntfs_index_root_inconsistent() checks that entries are
\nself-consistent within the IR value, but never cross-checks them against
\nindex_block_size. There is no bounds check in ntfs_ir_to_ib() before the
\nmemcpy.<\/p>\n
Fixing this at the sink in ntfs_ir_to_ib() since
\nntfs_index_root_inconsistent() validates the logical consistency of
\nindex_root as a structure and a root with large entries is a structurally
\nvalid root. The bug is a size conflict of ntfs_ir_to_ib().
\nAlso, the validator is called once per inode load in
\nntfs_read_locked_inode() while ntfs_ir_to_ib() is only called during a
\nreparent, a check there adds no overhead to the common path.
\nMoreover, even a future call path that bypasses the validator would still
\nbe protected.<\/p>\n
With NULL as first parameter of ntfs_error(), the volume error flag is
\nnever set by this call, so the device name will be absent from the error
\nmessage. In any case, that the caller, ntfs_ir_reparent(), prints an error
\nmessage that includes the device name on NULL returns.
\nI think this is the best solution available without adding
\n‘struct super_block *sb’ as a parameter to ntfs_ir_to_ib().<\/p>\n
This heap out-of-bounds write is triggered by a crafted filesystem image,
\nwhich is not in the kernel threat model, anyway, fixing memory errors would
\nbe nice to keep things secure.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: Fix index_root heap OOB write in ntfs_ir_to_ib()<\/p>\n
ntfs_ir_to_ib copies all entries from index_root into a freshly allocated
\ni<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25542","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25542","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}