In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: resize log->one_page_buf when adopting on-disk page size<\/p>\n
log_replay() allocates log->one_page_buf using the page size that was
\nchosen from the host PAGE_SIZE:<\/p>\n
\tlog->one_page_buf = kmalloc(log->page_size, GFP_NOFS);<\/p>\n
Later, when a restart area is found, the log page size recorded on disk
\nis adopted:<\/p>\n
\tt32 = le32_to_cpu(log->rst_info.r_page->sys_page_size);
\n\tif (log->page_size != t32) {
\n\t\tlog->l_size = log->orig_file_size;
\n\t\tlog->page_size = norm_file_page(t32, &log->l_size,
\n\t\t\t\t\t\tt32 == DefaultLogPageSize);
\n\t}<\/p>\n
If the on-disk page size is larger than the size used for the initial
\nallocation, log->page_size grows but one_page_buf is left at its
\noriginal, smaller size. A subsequent unaligned read_log_page() then
\nreads log->page_size bytes into the undersized scratch buffer:<\/p>\n
\tpage_buf = page_off ? log->one_page_buf : *buffer;
\n\terr = ntfs_read_run_nb_ra(ni->mi.sbi, &ni->file.run, page_vbo, page_buf,
\n\t\t\t\t log->page_size, NULL, &log->read_ahead);<\/p>\n
overflowing the allocation. This is reachable when mounting a dirty
\nNTFS volume whose log was formatted with a page size larger than the
\nbuffer initially allocated on the mounting host (for example a 64K-log
\nvolume mounted on a host that allocated a 4K scratch buffer).<\/p>\n
Grow one_page_buf when the adopted on-disk page size exceeds the size
\nused for the initial allocation. On krealloc() failure the original
\nbuffer is left intact and freed by the existing error path.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
fs\/ntfs3: resize log->one_page_buf when adopting on-disk page size<\/p>\n
log_replay() allocates log->one_page_buf using the page size th<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7137","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7137","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7137"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7137"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7137"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}