In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: avoid stale runlist element dereference in fallocate<\/p>\n
ntfs_attr_fallocate() allocates holes and delayed allocations inside
\ninitialized size by looking up the current runlist element under
\nni->runlist.lock. The returned struct runlist_element is only a borrowed
\npointer into ni->runlist.rl. A writer can replace and free that array
\nafter the read lock is dropped, so later reads of rl->lcn, rl->length and
\nrl->vcn can touch freed memory.<\/p>\n
The buggy scenario involves two paths, with each column showing the order
\nwithin that path:<\/p>\n
ntfs_attr_fallocate():
\n 1. Take ni->runlist.lock for read.
\n 2. Get rl from ntfs_attr_find_vcn_nolock().
\n 3. Drop ni->runlist.lock.
\n 4. Read rl->lcn, rl->length and rl->vcn.<\/p>\n
mmap page_mkwrite:
\n 1. Enter ntfs_filemap_page_mkwrite().
\n 2. Reach __ntfs_write_iomap_begin() and ntfs_attr_map_cluster().
\n 3. Merge allocation state with ntfs_runlists_merge().
\n 4. Reallocate ni->runlist.rl in ntfs_rl_realloc(), freeing the old array.<\/p>\n
Validation reproduced this kernel report:
\nBUG: KASAN: slab-use-after-free in ntfs_attr_fallocate+0xbb8\/0xd00<\/p>\n
Call Trace:<\/p>\n
dump_stack_lvl+0x66\/0xa0
\n print_report+0xce\/0x630
\n ? ntfs_attr_fallocate+0xbb8\/0xd00
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? __virt_addr_valid+0x20d\/0x410
\n ? ntfs_attr_fallocate+0xbb8\/0xd00
\n kasan_report+0xe0\/0x110
\n ? ntfs_attr_fallocate+0xbb8\/0xd00
\n ntfs_attr_fallocate+0xbb8\/0xd00
\n ? lock_acquire+0x2b8\/0x2f0
\n ? __pfx_ntfs_attr_fallocate+0x10\/0x10
\n ? 0xffffffffc0000095
\n ? down_write+0x10d\/0x1e0
\n ntfs_fallocate+0x5c9\/0x1d00
\n ? __pfx_ntfs_fallocate+0x10\/0x10
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? lock_acquire+0x2b8\/0x2f0
\n ? srso_alias_return_thunk+0x5\/0xfbef5
\n ? selinux_file_permission+0x3a7\/0x510
\n vfs_fallocate+0x29d\/0xd30
\n __x64_sys_fallocate+0xc7\/0x150
\n ? do_syscall_64+0x81\/0x6a0
\n do_syscall_64+0x115\/0x6a0
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
Allocated by task 410:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x14\/0x30
\n __kasan_kmalloc+0xaa\/0xb0
\n __kvmalloc_node_noprof+0x353\/0x920
\n ntfs_rl_realloc+0x3f\/0x110
\n ntfs_runlists_merge+0xaa3\/0x3010
\n ntfs_attr_map_cluster+0x4e5\/0xf80
\n ntfs_attr_fallocate+0x53f\/0xd00
\n ntfs_fallocate+0x5c9\/0x1d00
\n vfs_fallocate+0x29d\/0xd30
\n __x64_sys_fallocate+0xc7\/0x150
\n do_syscall_64+0x115\/0x6a0
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f<\/p>\n
Freed by task 424:
\n kasan_save_stack+0x33\/0x60
\n kasan_save_track+0x14\/0x30
\n kasan_save_free_info+0x3b\/0x60
\n __kasan_slab_free+0x5f\/0x80
\n kfree+0x307\/0x580
\n ntfs_rl_realloc+0x6f\/0x110
\n ntfs_runlists_merge+0x7b1\/0x3010
\n ntfs_attr_map_cluster+0x4e5\/0xf80
\n __ntfs_write_iomap_begin+0x8cd\/0x2280
\n iomap_iter+0x6de\/0x11e0
\n iomap_page_mkwrite+0x391\/0x650
\n ntfs_filemap_page_mkwrite+0x1ac\/0x400
\n do_page_mkwrite+0x15c\/0x280
\n __handle_mm_fault+0xd6d\/0x1ca0
\n handle_mm_fault+0x19c\/0x470
\n do_user_addr_fault+0x23b\/0x9c0
\n exc_page_fault+0x5c\/0xc0
\n asm_exc_page_fault+0x26\/0x30<\/p>\n
Fix this by copying the needed runlist fields while the read lock is still
\nheld and using only those scalar snapshots after unlocking.<\/p>\n
After the snapshot, ntfs_attr_map_cluster() can also find that the range
\nis already mapped and return balloc=false. Only call ntfs_dio_zero_range()
\nwhen new clusters were allocated, matching the write iomap path and
\npreserving the zero-newly-allocated-holes behavior.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ntfs: avoid stale runlist element dereference in fallocate<\/p>\n
ntfs_attr_fallocate() allocates holes and delayed allocations inside
\nin<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-6987","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/6987","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6987"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6987"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6987"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}