In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: validate external xattr entries when reading metadata<\/p>\n
ocfs2_validate_xattr_block() checks the xattr block header before the
\nblock reaches higher-level xattr users, but it does not verify that a
\nnon-indexed block’s xh_count and entry offsets fit inside the block.
\nIndexed buckets likewise reach list\/get consumers after ECC without an
\nentry-bounds check.<\/p>\n
Use the flat xattr entry validator for non-indexed external xattr blocks,
\nand use a bucket-specific validator for indexed buckets at metadata read
\ntime. The bucket validator keeps the entry array bounded by the first
\nbucket block while checking name\/value offsets against the bucket block
\nthey target.<\/p>\n
Reject corrupted external xattr metadata before listxattr() or getxattr()
\ncan walk out-of-range entry arrays or name\/value offsets.<\/p>\n
Validation reproduced this kernel report:
\nBUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7\/0x190
\nRead of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis\/630
\nCall Trace:
\n dump_stack_lvl+0x66\/0xa0
\n print_report+0xce\/0x630
\n kasan_report+0xe0\/0x110
\n ocfs2_xattr_list_entries+0xd7\/0x190
\n ocfs2_listxattr+0x3f6\/0x610
\n listxattr+0x90\/0xe0
\n path_listxattrat+0xed\/0x220
\n do_syscall_64+0x115\/0x6a0
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: validate external xattr entries when reading metadata<\/p>\n
ocfs2_validate_xattr_block() checks the xattr block header before the<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25729","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25729","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25729"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25729"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25729"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}