In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: bound DeleteIndexEntryAllocation memmove length<\/p>\n
In do_action()’s DeleteIndexEntryAllocation case, e->size comes
\nfrom an on-disk INDEX_BUFFER entry. When e->size makes
\ne + e->size point past hdr + hdr->used,
\nPtrOffset(e1, Add2Ptr(hdr, used)) returns a negative ptrdiff_t
\nthat is silently cast to a quasi-infinite size_t when passed
\nto memmove(). The memmove then walks past the destination
\nbuffer.<\/p>\n
The sibling DeleteIndexEntryRoot case at fslog.c:3540-3543
\nalready carries the corresponding guard:<\/p>\n
\tif (PtrOffset(e1, Add2Ptr(hdr, used)) Add2Ptr(lrh, rec_len) ||
\n\t used + esize > le32_to_cpu(hdr->total)) {
\n\t\tgoto dirty_vol;
\n\t}<\/p>\n
Apply the same shape to the allocation-path case. Also reject
\nesize == 0: memmove(e, e, …) is a no-op and leaves
\nhdr->used unchanged, hiding a malformed entry from the
\nexisting check_index_header() walk.<\/p>\n
Reproduced under UML+KASAN on mainline 8d90b09e6741 by
\nmounting a crafted NTFS image: the unguarded memmove takes a
\nlength of 0xffffffffffffff00 and the kernel oopses in
\nmemmove+0x81\/0x1a0 on the do_action+0x36a2 frame.<\/p>\n
[almaz.alexandrovich@paragon-software.com: clang-formatted the changes]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: bound DeleteIndexEntryAllocation memmove length<\/p>\n
In do_action()’s DeleteIndexEntryAllocation case, e->size comes
\nfrom an <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6828","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6828","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6828"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6828"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6828"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}