In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb\/client: fix stale page cache in insert\/collapse range<\/p>\n
smb3_insert_range() and smb3_collapse_range() use
\ntruncate_pagecache_range() to invalidate the affected page cache.
\nHowever, if off or old_eof is not page-aligned, the boundary pages are
\nonly partially zeroed and remain uptodate. As a result, the client may
\nreturn stale data after a successful insert\/collapse range operation.<\/p>\n
For example, with 4K pages:<\/p>\n
page 0 page 1 page 2
\n 0——4K 4K——8K 8K——12K
\n ^ ^
\n off=2K old_eof=10K<\/p>\n
Page 1 is removed from the page cache, while the boundary pages are
\nonly partially zeroed. After COPYCHUNK moves the data on the server,
\nthese cached pages may still return stale data.<\/p>\n
This can be reproduced on a CIFS mount:<\/p>\n
bash -c ‘
\n FILE=\/mnt\/scratch\/repro<\/p>\n
# Use a 6 KiB file so EOF is not page-aligned.
\n dd if=\/dev\/urandom of=\/tmp\/src bs=1K count=6 status=none<\/p>\n
# Expected: a 4 KiB hole followed by the original data.
\n rm -f \/tmp\/expected
\n truncate -s 4K \/tmp\/expected
\n cat \/tmp\/src >> \/tmp\/expected<\/p>\n
cp \/tmp\/src “$FILE”<\/p>\n
# Prime the page cache before moving data on the server.
\n cat “$FILE” > \/dev\/null<\/p>\n
fallocate –insert-range -o 0 -l 4K “$FILE”<\/p>\n
if cmp -s \/tmp\/expected “$FILE”; then
\n echo “readback: OK”
\n else
\n echo “readback: STALE DATA”
\n fi
\n ‘<\/p>\n
Fix this by writing back dirty data and discarding the page cache from
\nthe start of the page containing off to EOF before moving data on the
\nserver.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb\/client: fix stale page cache in insert\/collapse range<\/p>\n
smb3_insert_range() and smb3_collapse_range() use
\ntruncate_pagecache_ran<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29279","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29279","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29279"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29279"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29279"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}