In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: validate fast symlink target during inode read<\/p>\n
ocfs2_validate_inode_block() already rejects several inconsistent
\nself-contained dinodes before they are exposed to the rest of the
\nfilesystem. Fast symlinks need the same treatment.<\/p>\n
A zero-cluster symlink is treated as a fast symlink and later read through
\npage_get_link() and ocfs2_fast_symlink_read_folio(). That path uses
\nstrnlen() on the inline payload and then copies len + 1 bytes into the
\nfolio. If a corrupt dinode stores an i_size that does not fit the inline
\narea or omits the terminating NUL at i_size, that copy reads past the end
\nof the inode block buffer.<\/p>\n
Reject zero-cluster symlink dinodes whose i_size exceeds the inline
\nfast-symlink capacity or whose inline payload is not NUL-terminated
\nexactly at i_size when the inode block is validated. This keeps malformed
\nfast symlinks from reaching the read path.<\/p>\n
Validation reproduced this kernel report:
\nKASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c\/0x1f0
\nRIP: 0033:0x7f5c6d859aa7
\nRead of size 3905
\nCall trace:
\n dump_stack_lvl+0x66\/0xa0 (?:?)
\n print_report+0xce\/0x630 (?:?)
\n ocfs2_fast_symlink_read_folio+0x12c\/0x1f0 (fs\/ocfs2\/inode.c:?)
\n srso_alias_return_thunk+0x5\/0xfbef5 (?:?)
\n __virt_addr_valid+0x19f\/0x330 (?:?)
\n kasan_report+0xe0\/0x110 (?:?)
\n kasan_check_range+0x105\/0x1b0 (?:?)
\n __asan_memcpy+0x23\/0x60 (?:?)
\n filemap_read_folio+0x27\/0xe0 (?:?)
\n filemap_read_folio+0x35\/0xe0 (?:?)
\n do_read_cache_folio+0x138\/0x230 (?:?)
\n __page_get_link+0x26\/0x110 (?:?)
\n page_get_link+0x2e\/0x70 (?:?)
\n vfs_readlink+0x15e\/0x250 (?:?)
\n touch_atime+0x4d\/0x370 (?:?)
\n do_readlinkat+0x186\/0x200 (?:?)
\n do_user_addr_fault+0x65a\/0x890 (?:?)
\n __x64_sys_readlink+0x46\/0x60 (?:?)
\n do_syscall_64+0x115\/0x6a0 (arch\/x86\/entry\/syscall_64.c:87)
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f (?:?)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ocfs2: validate fast symlink target during inode read<\/p>\n
ocfs2_validate_inode_block() already rejects several inconsistent
\nself-conta<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7300","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}