In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: validate inline xattrs during inode block validation<\/p>\n
Patch series “ocfs2: validate xattr entry bounds”, v7.<\/p>\n
This series validates OCFS2 xattr entry name\/value bounds when xattr
\nmetadata is read and validated, before getxattr() or listxattr() can walk
\nout-of-range entry arrays or offsets from corrupted metadata.<\/p>\n
This patch (of 2):<\/p>\n
ocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk
\nmetadata from it, but inline xattr metadata is still checked only in
\noperation-specific consumers. The existing ibody lookup helper validates
\ninline header placement and entry count, but inode block validation does
\nnot reject entry name\/value bounds.<\/p>\n
Add a flat xattr entry validator and call it from inode block validation
\nfor inline xattrs. Keep the operation paths on their existing
\nheader\/count lookup checks; the full entry bounds check now runs when the
\ninode block is validated at read time.<\/p>\n
Reject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or
\nlistxattr() can walk past the inline storage.<\/p>\n
Validation reproduced this kernel report:
\nBUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a\/0x170
\nRead of size 2 at addr ffff8881242a2000 by task python3\/529
\nCall Trace:
\n dump_stack_lvl+0x66\/0xa0
\n print_report+0xce\/0x630
\n kasan_report+0xe0\/0x110
\n ocfs2_xattr_find_entry+0x5a\/0x170
\n ocfs2_xattr_get_nolock+0x20a\/0x820
\n ocfs2_xattr_get+0x10c\/0x1e0
\n __vfs_getxattr+0xe2\/0x130
\n vfs_getxattr+0x185\/0x1b0<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: validate inline xattrs during inode block validation<\/p>\n
Patch series “ocfs2: validate xattr entry bounds”, v7.<\/p>\n
This series va<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25730","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25730","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25730"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25730"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25730"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}