In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
exfat: fix valid_size extension over a shared writable mapping<\/p>\n
When a shared writable mapping has its valid_size extended by a buffered
\nwrite or a page fault, exfat zeroes the page-cache gap below the new
\nvalid_size. A store through the mapping can race with this zeroing and be
\noverwritten.<\/p>\n
Fix this by zeroing the gap lazily. Drop ->map_pages so that every first
\nwrite fault goes through exfat_page_mkwrite(), which advances valid_size to
\ncover the faulting page. With fault-around enabled, a store could install a
\nwritable PTE, skip ->page_mkwrite(), and land past valid_size without
\nadvancing it. Extending valid_size one faulting page at a time also leaves
\nnever-written pages in a large mapping alone.<\/p>\n
The gap is filled with block granularity, zeroing only the not-uptodate
\nblocks and preserving blocks that may hold data stored through the mapping.
\nOn the buffered-write path the invalidate lock is held and the gap is
\nunmapped before zeroing, so a racing store re-faults and, under the inode
\nlock, completes only after the gap has been zeroed and valid_size covers
\nit.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
exfat: fix valid_size extension over a shared writable mapping<\/p>\n
When a shared writable mapping has its valid_size extended by a buf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25856","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25856","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25856"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25856"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25856"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}