In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb\/client: validate new EOF for zero range<\/p>\n
When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,
\nsmb3_zero_range() may extend EOF without checking RLIMIT_FSIZE, allowing
\nthe file to grow beyond the caller’s file-size limit.<\/p>\n
Fix this by calling inode_newsize_ok() before sending the zero-range
\nrequest when the operation would extend EOF.<\/p>\n
Reproducer, using a file on a CIFS mount:<\/p>\n
\tbash -c ‘
\n\t FILE=\/mnt\/cifs\/repro<\/p>\n
\t trap “” SIGXFSZ
\n\t ulimit -f 3072<\/p>\n
\t truncate -s 2M “$FILE”
\n\t fallocate –zero-range -o 0 -l 4M “$FILE”
\n\t echo “fallocate rc=$?”
\n\t stat -c “file size=%s” “$FILE”
\n\t‘<\/p>\n
Before this change, the operation succeeds despite the 3 MiB limit:<\/p>\n
\tfallocate rc=0
\n\tfile size=4194304<\/p>\n
After this change, fallocate fails and leaves the file at 2 MiB.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
smb\/client: validate new EOF for zero range<\/p>\n
When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE,
\nsmb3_zero_range() may e<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29280","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29280","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29280"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29280"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29280"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}