Description
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix OOB in nilfs_set_de_type The size of the nilfs_type_by_mode array in the fs/nilfs2/dir.c file is defined as "S_IFMT >> S_SHIFT", but the nilfs_set_de_type() function, which uses this array, specifies the index to read from the array in the same way as "(mode & S_IFMT) >> S_SHIFT". static void nilfs_set_de_type(struct nilfs_dir_entry *de, struct inode *inode) { umode_t mode = inode->i_mode; de->file_type = nilfs_type_by_mode[(mode & S_IFMT)>>S_SHIFT]; // oob } However, when the index is determined this way, an out-of-bounds (OOB) error occurs by referring to an index that is 1 larger than the array size when the condition "mode & S_IFMT == S_IFMT" is satisfied. Therefore, a patch to resize the nilfs_type_by_mode array should be applied to prevent OOB errors.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
2ba466d74ed74f073257f86e61519cb8f8f46184 to < 054f29e9ca05be3906544c5f2a2c7321c30a4243affected2ba466d74ed74f073257f86e61519cb8f8f46184 to < 90f43980ea6be4ad903e389be9a27a2a0018f1c8affected2ba466d74ed74f073257f86e61519cb8f8f46184 to < 7061c7efbb9e8f11ce92d6b4646405ea2b0b4de1affected2ba466d74ed74f073257f86e61519cb8f8f46184 to < bdbe483da21f852c93b22557b146bc4d989260f0affected2ba466d74ed74f073257f86e61519cb8f8f46184 to < 897ac5306bbeb83e90c437326f7044c79a17c611affected2ba466d74ed74f073257f86e61519cb8f8f46184 to < 2382eae66b196c31893984a538908c3eb7506ff9affected2ba466d74ed74f073257f86e61519cb8f8f46184 to < 90823f8d9ecca3d5fa6b102c8e464c62f416975faffected2ba466d74ed74f073257f86e61519cb8f8f46184 to < c4a7dc9523b59b3e73fd522c73e95e072f876b16affected
Linux Linux
Default version status: affected
2.6.30affected0 to < 2.6.30unaffected4.19.313 to ≤ 4.19.*unaffected5.4.275 to ≤ 5.4.*unaffected5.10.216 to ≤ 5.10.*unaffected5.15.157 to ≤ 5.15.*unaffected6.1.88 to ≤ 6.1.*unaffected6.6.29 to ≤ 6.6.*unaffected6.8.8 to ≤ 6.8.*unaffected6.9 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/054f29e9ca05be3906544c5f2a2c7321c30a4243 ↗
- https://git.kernel.org/stable/c/90f43980ea6be4ad903e389be9a27a2a0018f1c8 ↗
- https://git.kernel.org/stable/c/7061c7efbb9e8f11ce92d6b4646405ea2b0b4de1 ↗
- https://git.kernel.org/stable/c/bdbe483da21f852c93b22557b146bc4d989260f0 ↗
- https://git.kernel.org/stable/c/897ac5306bbeb83e90c437326f7044c79a17c611 ↗
- https://git.kernel.org/stable/c/2382eae66b196c31893984a538908c3eb7506ff9 ↗
- https://git.kernel.org/stable/c/90823f8d9ecca3d5fa6b102c8e464c62f416975f ↗
- https://git.kernel.org/stable/c/c4a7dc9523b59b3e73fd522c73e95e072f876b16 ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html ↗
- https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAMSOZXJEPUOXW33WZYWCVAY7Z5S7OOY/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EZ6PJW7VOZ224TD7N4JZNU6KV32ZJ53/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GCBZZEC7L7KTWWAS2NLJK6SO3IZIL4WW/ ↗