In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb\/client: invalidate fscache for fallocate range operations<\/p>\n
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and
\nsmb3_collapse_range() modify file contents through server-side range
\noperations. These operations discard the affected page cache, but leave
\nthe FS-Cache cookie valid, so a later read may return data cached before
\nthe range operation.<\/p>\n
Fix this by invalidating FS-Cache after outstanding I\/O has completed
\nand before modifying the file on the server.<\/p>\n
Run the following as root on a CIFS mount with fsc enabled and an active
\nCacheFiles backend:<\/p>\n
bash -c ‘
\n MNT=\/mnt\/cifs
\n FILE=”$MNT\/repro”<\/p>\n
# Generate four 1 MiB random blocks: [A][B][C][D].
\n dd if=\/dev\/urandom of=\/tmp\/src bs=1M count=4 status=none<\/p>\n
# Expected contents after zeroing B: [A][zero][C][D].
\n cp \/tmp\/src \/tmp\/expected
\n dd if=\/dev\/zero of=\/tmp\/expected bs=1M seek=1 count=1
\n conv=notrunc status=none
\n cp \/tmp\/src “$FILE”<\/p>\n
# Populate FS-Cache, then discard the page cache.
\n sync
\n echo 1 > \/proc\/sys\/vm\/drop_caches
\n cat “$FILE” > \/dev\/null
\n sync
\n echo 1 > \/proc\/sys\/vm\/drop_caches<\/p>\n
fallocate –zero-range -o 1M -l 1M “$FILE”<\/p>\n
if cmp -s \/tmp\/expected “$FILE”; then
\n echo “readback: OK”
\n else
\n echo “readback: STALE DATA”
\n fi
\n ‘<\/p>\n
Before this change, the readback differs from \/tmp\/expected:<\/p>\n
readback: STALE DATA<\/p>\n
After this change, it matches:<\/p>\n
readback: OK<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb\/client: invalidate fscache for fallocate range operations<\/p>\n
smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and
\nsmb3_<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29278","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29278","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29278"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29278"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29278"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}