In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
minix: avoid overflow in bitmap block count calculation<\/p>\n
minix_check_superblock() uses minix_blocks_needed() to verify that the
\non-disk imap and zmap block counts are large enough for the advertised
\ninode and zone counts.<\/p>\n
The helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.
\nA Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the
\naddition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap\/zmap
\nblock count look valid, after which minix_fill_super() can dereference
\ns_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.<\/p>\n
Impact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is
\nnear UINT_MAX makes minix_check_superblock() accept a zero bitmap-block
\ncount and minix_fill_super() dereference s_imap[0]\/s_zmap[0], panicking
\nthe kernel.<\/p>\n
The divisor is the bitmap capacity in bits, blocksize * 8, which is
\nalways a power of two: minix_fill_super() obtains the block size through
\nsb_set_blocksize(), and blk_validate_block_size() rejects any size that
\nis not a power of two. Use DIV_ROUND_UP_POW2(), which divides before
\nadding the round-up term and so cannot overflow for a power-of-two
\ndivisor.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
minix: avoid overflow in bitmap block count calculation<\/p>\n
minix_check_superblock() uses minix_blocks_needed() to verify that the
\non-<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7009","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}