In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow<\/p>\n
indx_find_buffer() recursively descends the B+ tree index with no depth
\nlimit. A crafted NTFS image with circular index node references causes
\nunbounded recursion, overflowing the kernel stack and panicking the
\nsystem.<\/p>\n
This is reachable by mounting a malicious NTFS filesystem (e.g. from a
\nUSB drive via desktop automount) and deleting a file whose index entry
\ntriggers the rebalancing fallback path in indx_delete_entry().<\/p>\n
Add a depth parameter and bail out with -EINVAL when it reaches the
\nfnd->nodes array bound, matching the constraint already enforced by
\nfnd_push() in indx_find().<\/p>\n
The related function indx_find() was previously patched for a similar
\ninfinite-loop issue (commit 1732053c8a6b), but indx_find_buffer() was
\nmissed.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: add depth limit to indx_find_buffer to prevent stack overflow<\/p>\n
indx_find_buffer() recursively descends the B+ tree index <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6825","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6825","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6825"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6825"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6825"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}