Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfs_load_attr_list(). The "size" comes from le32_to_cpu(attr->res.data_size) so it can't overflow on a 64bit systems but on 32bit systems the "+ 1023" can overflow and the result is zero. This means that the kmalloc will succeed by returning the ZERO_SIZE_PTR and then the memcpy() will crash with an Oops on the next line.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
be71b5cba2e6485e8959da7a9f9a44461a1bb074 to < ae4acad41b0f93f1c26cc0fc9135bb79d8282d0baffectedbe71b5cba2e6485e8959da7a9f9a44461a1bb074 to < ec1bedd797588fe38fc11cba26d77bb1d9b194c6affectedbe71b5cba2e6485e8959da7a9f9a44461a1bb074 to < fb7bcd1722bc9bc55160378f5f99c01198fd14a7affectedbe71b5cba2e6485e8959da7a9f9a44461a1bb074 to < 686820fe141ea0220fc6fdfc7e5694f915cf64b2affectedbe71b5cba2e6485e8959da7a9f9a44461a1bb074 to < b2dd7b953c25ffd5912dda17e980e7168bebcf6caffected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.149 to ≤ 5.15.*unaffected6.1.78 to ≤ 6.1.*unaffected6.6.17 to ≤ 6.6.*unaffected6.7.5 to ≤ 6.7.*unaffected6.8 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ae4acad41b0f93f1c26cc0fc9135bb79d8282d0b ↗
- https://git.kernel.org/stable/c/ec1bedd797588fe38fc11cba26d77bb1d9b194c6 ↗
- https://git.kernel.org/stable/c/fb7bcd1722bc9bc55160378f5f99c01198fd14a7 ↗
- https://git.kernel.org/stable/c/686820fe141ea0220fc6fdfc7e5694f915cf64b2 ↗
- https://git.kernel.org/stable/c/b2dd7b953c25ffd5912dda17e980e7168bebcf6c ↗