In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec<\/p>\n
[BUG]
\nOn-disk corruption setting l_next_free_rec to 0 in an inode’s embedded
\nextent list triggers a UBSAN panic on the next write to that file.<\/p>\n
[CAUSE]
\nocfs2_sum_rightmost_rec() computes
\ni = le16_to_cpu(el->l_next_free_rec) – 1
\nand accesses el->l_recs[i] without validating i. When l_next_free_rec
\nis 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls
\npast the end of the array. Either case violates the
\n__counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.<\/p>\n
[FIX]
\nValidate the inode’s embedded extent list when the inode is read, in
\nocfs2_validate_inode_block(): l_count must be non-zero and no larger
\nthan the inode block can hold, and l_next_free_rec must not exceed
\nl_count. A corrupt list is rejected at read time, before the b-tree
\ncode can index l_recs[] out of bounds.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec<\/p>\n
[BUG]
\nOn-disk corruption setting l_next_free_rec to 0 in an <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6811","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6811","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6811"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6811"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6811"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}