In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ufs: validate cylinder group metadata before caching it<\/p>\n
ufs_read_cylinder() copies the cylinder group index and the rotor
\npositions straight from the on-disk group and caches them without any
\ncheck:<\/p>\n
\tucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx);
\n\tucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor);
\n\tucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor);
\n\tucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor);<\/p>\n
They are then used as indices during allocation and free:<\/p>\n
– c_cgx indexes the cylinder summary array as
\n UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32
\n bit count outside the s_csp allocation.<\/p>\n
– c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and
\n then length = ((s_fpg + 7) >> 3) – start. A start beyond the block
\n bitmap wraps the unsigned length to a huge value, so ubh_scanc()
\n walks far past the cylinder group buffers. c_irotor drives the
\n inode bitmap the same way.<\/p>\n
A crafted image can set any of these freely, turning an ordinary
\nallocation into an out of bounds access.<\/p>\n
Reject a cylinder group whose recorded index does not match the group
\nbeing read, or whose rotors fall outside the group, before the metadata
\nis cached. Valid filesystems keep cg_cgx equal to the group number and
\nthe rotors within the group, so only malformed images are rejected.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ufs: validate cylinder group metadata before caching it<\/p>\n
ufs_read_cylinder() copies the cylinder group index and the rotor
\nposition<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29082","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}