In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
squashfs: Add dictionary size range check to prevent shift-out-of-bounds<\/p>\n
When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size
\nis 0) is mounted, and performs shift operations using dictionarysize, the
\nshift exponent is -1, causing a shift-out-of-bounds.<\/p>\n
Detail as below:
\nsquashfs_comp_opts(msblk, buffer, length)
\n squashfs_xz_comp_opts()
\n if (comp_opts)
\n n = ffs(opts->dict_size) – 1;dict_size=0, n=-1
\n if (opts->dict_size != (1 <dict_size !=
\n\t \t(1 << n) + (1 << (n + 1))) <—-shift-out-of-bounds<\/p>\n
Fix it by adding a dictionary size range check before the shift operation.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
squashfs: Add dictionary size range check to prevent shift-out-of-bounds<\/p>\n
When an abnormal SquashFS image (COMP_OPTS flag is 1 but <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41108","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41108","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41108"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41108"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41108"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}