In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix integer overflow in MFT cluster validation<\/p>\n
In ntfs_init_from_boot(), the boot sector’s MFT cluster numbers are
\nvalidated against the volume size with:<\/p>\n
\tif (mlcn * sct_per_clst >= sectors ||
\n\t mlcn2 * sct_per_clst >= sectors)
\n\t\tgoto out;<\/p>\n
mlcn and mlcn2 are u64 fields read directly from the boot sector.
\nsct_per_clst is bounded above by 4096 (true_sectors_per_clst() plus
\nthe is_power_of_2() check below it), but the multiplication is done
\nin u64 and wraps when mlcn (or mlcn2) is large enough — e.g. mlcn
\nnear 2^62 with sct_per_clst == 4 wraps to 0, which compares below
\nany non-zero ‘sectors’, so the check is bypassed and the malformed
\nrecord is accepted.<\/p>\n
The accepted mlcn is then used unchanged in<\/p>\n
\tsbi->mft.lbo = mlcn <= sectors) instead of
\nswitching to division (mlcn >= sectors \/ sct_per_clst), which
\nwould tighten the check at edge cases where ‘sectors’ is not a
\nmultiple of sct_per_clst. The check_*_overflow() style is the
\none ntfs3 already uses for similar on-disk arithmetic in
\nfs\/ntfs3\/run.c.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: fix integer overflow in MFT cluster validation<\/p>\n
In ntfs_init_from_boot(), the boot sector’s MFT cluster numbers are
\nvalid<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25609","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25609","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25609"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25609"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25609"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}