Description
In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy h_size fixup Commit a70f9fe52daa ("xfs: detect and handle invalid iclog size set by mkfs") added a fixup for incorrect h_size values used for the initial umount record in old xfsprogs versions. Later commit 0c771b99d6c9 ("xfs: clean up calculation of LR header blocks") cleaned up the log reover buffer calculation, but stoped using the fixed up h_size value to size the log recovery buffer, which can lead to an out of bounds access when the incorrect h_size does not come from the old mkfs tool, but a fuzzer. Fix this by open coding xlog_logrec_hblks and taking the fixed h_size into account for this calculation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
0c771b99d6c9a0552fea5cc43669b726dad8f659 to < f754591b17d0ee91c2b45fe9509d0cdc420527cbaffected0c771b99d6c9a0552fea5cc43669b726dad8f659 to < 57835c0e7152e36b03875dd6c56dfeed685c1b1faffected0c771b99d6c9a0552fea5cc43669b726dad8f659 to < c2389c074973aa94e34992e7f66dac0de37595b5affected0c771b99d6c9a0552fea5cc43669b726dad8f659 to < 45cf976008ddef4a9c9a30310c9b4fb2a9a6602aaffected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected5.15.165 to ≤ 5.15.*unaffected6.1.105 to ≤ 6.1.*unaffected6.6.46 to ≤ 6.6.*unaffected6.10 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/f754591b17d0ee91c2b45fe9509d0cdc420527cb ↗
- https://git.kernel.org/stable/c/57835c0e7152e36b03875dd6c56dfeed685c1b1f ↗
- https://git.kernel.org/stable/c/c2389c074973aa94e34992e7f66dac0de37595b5 ↗
- https://git.kernel.org/stable/c/45cf976008ddef4a9c9a30310c9b4fb2a9a6602a ↗
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html ↗