In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()<\/p>\n
When ntfs_map_runlist_nolock() needs to look up the attribute extent
\ncontaining a target VCN (ctx_needs_reset == true), it calls
\nntfs_attr_lookup() and then expects the result to be a non-resident
\nattribute, since only non-resident attributes have a mapping pairs
\narray to decompress.<\/p>\n
A crafted NTFS image can place a resident attribute where a non-resident
\none is expected, causing ntfs_attr_lookup() to succeed but return a
\nresident attribute record. Previously this was caught only by a
\nWARN_ON(), which does not stop execution. The code then falls through to
\nread a->data.non_resident.highest_vcn from what is actually a resident
\nattribute, accessing the wrong union member and corrupting the VCN range
\ncheck.<\/p>\n
The caller path triggering this warning during mount is:<\/p>\n
ntfs_map_runlist_nolock
\n ntfs_empty_logfile
\n load_system_files
\n ntfs_fill_super<\/p>\n
In this path ctx is NULL, so ntfs_map_runlist_nolock() allocates a
\ntemporary search context internally and sets ctx_needs_reset = true.
\nThe existing resident-attribute guard in the ctx != NULL branch already
\nreturns -EIO silently for the same condition; make the ctx_needs_reset
\npath consistent by replacing the WARN_ON() with the same -EIO error
\nreturn.<\/p>\n
This causes the crafted image to be rejected with a mount error instead
\nof triggering a kernel warning.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: fix WARN_ON for resident attribute in ntfs_map_runlist_nolock()<\/p>\n
When ntfs_map_runlist_nolock() needs to look up the attribut<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6820","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}