In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hfsplus: validate thread record before delete key rebuild<\/p>\n
hfsplus_delete_cat() is called with str == NULL when the last open
\nreference to an unlinked HFS+ hardlink backing inode is closed. In that
\ncase, the function finds the catalog thread by CNID and rebuilds the
\ncatalog key from thread.nodeName.<\/p>\n
That reconstruction path reads thread.nodeName.length directly from the
\ncatalog B-tree into fd.search_key and then copies length * 2 bytes into
\nfd.search_key->cat.name.unicode. It does not first check that the found
\nrecord is a thread record or that its size matches the thread name.<\/p>\n
A corrupted image can therefore provide an oversized thread name length
\nand make hfs_bnode_read() write past the catalog search-key allocation.<\/p>\n
Read the CNID record through hfsplus_brec_read_cat(), which bounds the
\nrecord read to sizeof(hfsplus_cat_entry) and verifies that a thread
\nrecord’s size exactly matches nodeName.length. Together, these checks
\nensure an accepted thread name fits HFSPLUS_MAX_STRLEN. Reject non-thread
\nrecords before building the delete key from the validated thread name.<\/p>\n
Share the thread-record-type helper between hfsplus_find_cat() and
\nhfsplus_delete_cat().<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
hfsplus: validate thread record before delete key rebuild<\/p>\n
hfsplus_delete_cat() is called with str == NULL when the last open
\nrefer<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25952","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25952","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25952"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25952"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25952"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}