In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ext4: validate readdir offset before accessing dirent<\/p>\n
A corrupted directory can trigger the following KASAN report when
\next4_readdir() resumes from an invalid position:<\/p>\n
BUG: KASAN: use-after-free in __ext4_check_dir_entry+0x5ef\/0x820
\n Read of size 2 at addr ffff88810a646000 by task repro_linear\/509<\/p>\n
Call Trace:<\/p>\n
dump_stack_lvl+0x53\/0x70
\n print_report+0xd0\/0x630
\n kasan_report+0xce\/0x100
\n __ext4_check_dir_entry+0x5ef\/0x820
\n ext4_readdir+0xcde\/0x2b70
\n iterate_dir+0x1a1\/0x520
\n __x64_sys_getdents64+0x12b\/0x220
\n do_syscall_64+0xf9\/0x540
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
KASAN reports use-after-free because the out-of-bounds access lands in an
\nadjacent freed page. The directory buffer itself is still referenced.<\/p>\n
ext4_dir_llseek() invalidates the directory cookie so that ext4_readdir()
\nrescans directory entries from the start of the block. The rescan checks
\nonly the lower bound of rec_len before advancing. A corrupted rec_len can
\ntherefore place the offset where the block has insufficient space for a
\ncomplete directory entry. The rescan itself may dereference that truncated
\nentry, or the main loop may pass it to __ext4_check_dir_entry(). The latter
\nreads de->rec_len before validating the range. For example:<\/p>\n
block offset 0 4092 4096
\n |—- de1.rec_len = 4092 —–|—-|
\n de2.inode
\n | de2.rec_len
\n ^ OOB, reported as UAF<\/p>\n
de2 starts at offset 4092 in this 4 KiB block. Its four-byte inode fits in
\nthe block, but its rec_len starts at offset 4096 and crosses the boundary.<\/p>\n
The minimum safe length is inode-dependent. Encrypted and casefolded
\ndirectory entries need eight additional hash bytes, while a valid metadata
\nchecksum tail is only 12 bytes.<\/p>\n
Cache the metadata checksum feature state and derive the minimum directory
\nentry length from the on-disk format. Use it to bound both the rescan and
\nthe offset passed to the main loop. Report an offset in a truncated block
\ntail and skip the remainder of the block, while continuing to accept an
\noffset exactly at the block boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ext4: validate readdir offset before accessing dirent<\/p>\n
A corrupted directory can trigger the following KASAN report when
\next4_readd<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25868","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25868","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25868"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25868"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}