In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()<\/p>\n
mtd_add_partition() does not reject the special offset value
\nMTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in
\nadd_mtd_device() when called through the BLKPG ioctl on NAND
\ndevices. The RETAIN value depends on cur_offset being the end of
\nthe previous partition, but in the dynamic partition path
\ncur_offset equals the offset argument itself, causing undefined
\nbehavior.<\/p>\n
Commit 5daa7b21496a (“mtd: prepare partition add and del functions
\nfor ioctl requests”) introduced mtd_add_partition() and correctly
\nrejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2),
\nsince those special offsets rely on cur_offset tracking the
\nprevious partition’s end. However, commit 1a31368bf92e (“mtd: add a flags
\nfor partitions which should just leave smth. after them”)
\nlater added MTDPART_OFS_RETAIN (-3) for the static
\npartition table path without updating mtd_add_partition() to
\nalso reject this value.<\/p>\n
With offset=-3 passed via BLKPG, the RETAIN size calculation in
\nallocate_partition() underflows (parent_size – 0xFFFFFFFFFFFFFFFD
\n= parent_size + 3). If the underflow result does not appear to
\nleave enough space, allocate_partition() jumps to out_register via
\ngoto, skipping erasesize initialization. This results in
\nerasesize=0, which triggers:<\/p>\n
WARN_ON((!mtd->erasesize || !master->_erase) &&
\n\t\t!(mtd->flags & MTD_NO_ERASE))<\/p>\n
in add_mtd_device(). If the underflow result appears to leave
\nenough space, a bogus partition size is calculated, but the
\n“out of reach” sanity check catches the invalid offset and
\ncreates a disabled empty partition (offset=0, size=0) instead
\nof returning an error.<\/p>\n
Fix this by adding MTDPART_OFS_RETAIN to the rejection list in
\nmtd_add_partition(), consistent with the existing handling of
\nAPPEND and NXTBLK.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()<\/p>\n
mtd_add_partition() does not reject the special offset value
\nMTDPART_O<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25907","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25907","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25907"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25907"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25907"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}