In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: reject out-of-range evcn in mi_enum_attr()<\/p>\n
In mi_enum_attr(), the start\/end VCN validation for non-resident
\nattributes is:<\/p>\n
\tif (svcn > evcn + 1) goto out;<\/p>\n
When evcn is U64_MAX the “evcn + 1” expression wraps to 0 and any svcn
\npasses the check. For evcn values close to U64_MAX (but not equal to it)
\nthe right-hand side is still a meaningless near-wrap upper bound, so a
\nmalformed on-disk attribute with svcn == 0 and evcn near U64_MAX can pass
\nmi_enum_attr() unrejected.<\/p>\n
VCN (virtual cluster number) is a cluster index, so any valid evcn is
\nbounded by the volume’s total cluster count, which ntfs3 holds in
\nsbi->used.bitmap.nbits (set up in ntfs_init_from_boot() before any caller
\nof mi_enum_attr() runs). Reject evcn values that fall outside this range.<\/p>\n
However, an empty non-resident attribute (no allocated clusters) is
\nlegitimately encoded with svcn == 0 and evcn == -1 (U64_MAX), e.g. via
\nattr->nres.evcn = cpu_to_le64((u64)vcn – 1) with vcn == 0. That sentinel
\nmust keep passing, so exclude evcn == U64_MAX from the range check. The
\nexisting “svcn > evcn + 1” test still tolerates the sentinel (“0 > 0” is
\nfalse) and continues to require svcn == 0 for it, while the range check
\nrejects every other out-of-range evcn and thereby also defuses the
\n“evcn + 1″ wraparound.<\/p>\n
svcn does not need its own bound: once evcn evcn + 1”
\nimplies svcn <= nbits.<\/p>\n
[almaz.alexandrovich@paragon-software.com: fixed evcn check]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: reject out-of-range evcn in mi_enum_attr()<\/p>\n
In mi_enum_attr(), the start\/end VCN validation for non-resident
\nattributes i<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25608","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25608","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25608"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25608"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25608"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}