In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: reject invalid sectors_per_cluster in the boot sector<\/p>\n
is_boot_sector_ntfs() checks the boot sector’s sectors_per_cluster field
\nwith a range test that rejects 0x81..0xf3 but accepts 0 and other
\nnon-power-of-two counts. A zero value reaches parse_ntfs_boot_sector():<\/p>\n
\tsectors_per_cluster_bits = ffs(sectors_per_cluster) – 1;
\n\t…
\n\tvol->cluster_size = vol->sector_size << sectors_per_cluster_bits;<\/p>\n
ffs(0) is 0, so sectors_per_cluster_bits becomes (unsigned)-1 and the
\nshift is undefined:<\/p>\n
UBSAN: shift-out-of-bounds in fs\/ntfs\/super.c:673:39
\n shift exponent 4294967295 is too large for 32-bit type 'int'<\/p>\n
This change rejects any non-power-of-two value, since it feeds the
\naforementioned shift via ffs() – 1, which only yields the correct shift for a
\npower of two.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: reject invalid sectors_per_cluster in the boot sector<\/p>\n
is_boot_sector_ntfs() checks the boot sector’s sectors_per_cluster fie<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29289","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29289","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29289"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29289"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29289"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}