In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: check for NULL root inode in fuse_fill_super_submount<\/p>\n
fuse_iget() can return NULL when its inode allocation fails, but
\nfuse_fill_super_submount() passed the result straight to get_fuse_inode()
\nand decremented fi->nlookup without checking it:<\/p>\n
root = fuse_iget(sb, parent_fi->nodeid, …);
\n fi = get_fuse_inode(root);
\n fi->nlookup–;<\/p>\n
Inside fuse_iget() the inode allocation can fail and return NULL. The
\nsubmount root takes the iget5_locked() path, whose alloc_inode() can fail
\nunder memory pressure (the auto-submount branch can fail the same way in
\nnew_inode() or fuse_alloc_submount_lookup()):<\/p>\n
inode = iget5_locked(sb, nodeid, fuse_inode_eq, fuse_inode_set,
\n &nodeid);
\n if (!inode)
\n return NULL;<\/p>\n
A NULL root makes get_fuse_inode() a container_of() on NULL and the
\nnlookup decrement a write to a bogus address, oopsing the mount. With
\nCONFIG_KASAN the following null pointer dereference is reported when the
\nroot inode allocation of an auto-submount fails (e.g. under memory
\npressure):<\/p>\n
==================================================================
\nBUG: KASAN: null-ptr-deref in fuse_get_tree_submount+0x656\/0x8b0
\nRead of size 8 at addr 00000000000002b0 by task ls\/942
\nCPU: 0 PID: 942 Comm: ls Tainted: G W 6.6 #15
\nCall Trace:<\/p>\n
fuse_get_tree_submount+0x656\/0x8b0
\n vfs_get_tree+0x48\/0x140
\n fc_mount+0x13\/0x50
\n fuse_dentry_automount+0x7a\/0xb0
\n __traverse_mounts+0xca\/0x330
\n step_into+0x339\/0xac0
\n path_lookupat+0xc5\/0x2f0
\n filename_lookup+0x163\/0x2a0
\n vfs_statx+0xd5\/0x200
\n do_statx+0x83\/0xd0
\n __x64_sys_statx+0xa0\/0xc0
\n do_syscall_64+0x37\/0x90
\n entry_SYSCALL_64_after_hwframe+0x78\/0xe2<\/p>\n
==================================================================<\/p>\n
Return -ENOMEM instead; the caller tears down the partially built
\nsuperblock on error, matching the other error returns in this
\nfunction.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fuse: check for NULL root inode in fuse_fill_super_submount<\/p>\n
fuse_iget() can return NULL when its inode allocation fails, but
\nfuse_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25548","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25548","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25548"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25548"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25548"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}