Description
In the Linux kernel, the following vulnerability has been resolved: fs: ntfs3: check return value of indx_find to avoid infinite loop We found an infinite loop bug in the ntfs3 file system that can lead to a Denial-of-Service (DoS) condition. A malformed dentry in the ntfs3 filesystem can cause the kernel to hang during the lookup operations. By setting the HAS_SUB_NODE flag in an INDEX_ENTRY within a directory's INDEX_ALLOCATION block and manipulating the VCN pointer, an attacker can cause the indx_find() function to repeatedly read the same block, allocating 4 KB of memory each time. The kernel lacks VCN loop detection and depth limits, causing memory exhaustion and an OOM crash. This patch adds a return value check for fnd_push() to prevent a memory exhaustion vulnerability caused by infinite loops. When the index exceeds the size of the fnd->nodes array, fnd_push() returns -EINVAL. The indx_find() function checks this return value and stops processing, preventing further memory allocation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
82cae269cfa953032fbb8980a7d554d60fb00b17 to < 14c3188afbedfd5178bbabb8002487ea14b37b56affected82cae269cfa953032fbb8980a7d554d60fb00b17 to < 435d34719db0e130f6f0c621d67ed524cc1a7d10affected82cae269cfa953032fbb8980a7d554d60fb00b17 to < 68e32694be231c1cdb99b7637a657314e88e1a96affected82cae269cfa953032fbb8980a7d554d60fb00b17 to < 398e768d1accd1f5645492ab996005d7aa84a5b0affected82cae269cfa953032fbb8980a7d554d60fb00b17 to < b0ea441f44ce64fa514a415d4a9e6e2b06e7946caffected82cae269cfa953032fbb8980a7d554d60fb00b17 to < 0ad7a1be44479503dbe5c699759861ef5b8bd70caffected82cae269cfa953032fbb8980a7d554d60fb00b17 to < 1732053c8a6b360e2d5afb1b34fe9779398b072caffected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.16 to ≤ 6.18.*unaffected6.19.6 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/14c3188afbedfd5178bbabb8002487ea14b37b56 ↗
- https://git.kernel.org/stable/c/435d34719db0e130f6f0c621d67ed524cc1a7d10 ↗
- https://git.kernel.org/stable/c/68e32694be231c1cdb99b7637a657314e88e1a96 ↗
- https://git.kernel.org/stable/c/398e768d1accd1f5645492ab996005d7aa84a5b0 ↗
- https://git.kernel.org/stable/c/b0ea441f44ce64fa514a415d4a9e6e2b06e7946c ↗
- https://git.kernel.org/stable/c/0ad7a1be44479503dbe5c699759861ef5b8bd70c ↗
- https://git.kernel.org/stable/c/1732053c8a6b360e2d5afb1b34fe9779398b072c ↗
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html ↗
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html ↗