In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dm-verity: fix buffer overflow in FEC calculation<\/p>\n
There’s a buffer overflow in dm-verity-fec:<\/p>\n
if (neras && *neras fec->roots)
\n\tfio->erasures[(*neras)++] = i;<\/p>\n
This allows *neras to reach roots + 1 (the post-increment pushes it past
\nroots). This value is then passed as no_eras to decode_rs8(). Inside the
\nRS decoder (lib\/reed_solomon\/decode_rs.c:113-121), the erasure locator
\npolynomial loop writes lambda[j] where j can reach nroots + 1 \u2014 one
\nelement past the end of lambda[] (which is sized nroots + 1, valid
\nindices 0..nroots). The out-of-bounds write lands on syn[0], corrupting
\nthe syndrome buffer.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
dm-verity: fix buffer overflow in FEC calculation<\/p>\n
There’s a buffer overflow in dm-verity-fec:<\/p>\n
if (neras && *neras fec->roots)
\n\tfi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6769","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6769","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6769"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6769"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6769"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}