Description
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check metadata block offset is within range Syzkaller reports a "general protection fault in squashfs_copy_data" This is ultimately caused by a corrupted index look-up table, which produces a negative metadata block offset. This is subsequently passed to squashfs_copy_data (via squashfs_read_metadata) where the negative offset causes an out of bounds access. The fix is to check that the offset is within range in squashfs_read_metadata. This will trap this and other cases.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f400e12656ab518be107febfe2315fb1eab5a342 to < 60f679f643f3f36a8571ea585e4ce5d93ef952b5affectedf400e12656ab518be107febfe2315fb1eab5a342 to < 3f68a9457a6190814377577374da75f872e0a013affectedf400e12656ab518be107febfe2315fb1eab5a342 to < 0c8ab092aec3ac4294940054772d30b511b16713affectedf400e12656ab518be107febfe2315fb1eab5a342 to < 6b847d65f5b0065e02080c61fad93d57d6686383affectedf400e12656ab518be107febfe2315fb1eab5a342 to < 9e9fa5ad37c9cbad73c165c7ff1e76e650825e7caffectedf400e12656ab518be107febfe2315fb1eab5a342 to < 01ee0bcc29864b78249308e8b35042b09bbf5fe3affectedf400e12656ab518be107febfe2315fb1eab5a342 to < 3b9499e7d677dd4366239a292238489a804936b2affectedf400e12656ab518be107febfe2315fb1eab5a342 to < fdb24a820a5832ec4532273282cbd4f22c291a0daffected
Linux Linux
Default version status: affected
2.6.29affected0 to < 2.6.29unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.167 to ≤ 6.1.*unaffected6.6.130 to ≤ 6.6.*unaffected6.12.77 to ≤ 6.12.*unaffected6.18.17 to ≤ 6.18.*unaffected6.19.7 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/60f679f643f3f36a8571ea585e4ce5d93ef952b5 ↗
- https://git.kernel.org/stable/c/3f68a9457a6190814377577374da75f872e0a013 ↗
- https://git.kernel.org/stable/c/0c8ab092aec3ac4294940054772d30b511b16713 ↗
- https://git.kernel.org/stable/c/6b847d65f5b0065e02080c61fad93d57d6686383 ↗
- https://git.kernel.org/stable/c/9e9fa5ad37c9cbad73c165c7ff1e76e650825e7c ↗
- https://git.kernel.org/stable/c/01ee0bcc29864b78249308e8b35042b09bbf5fe3 ↗
- https://git.kernel.org/stable/c/3b9499e7d677dd4366239a292238489a804936b2 ↗
- https://git.kernel.org/stable/c/fdb24a820a5832ec4532273282cbd4f22c291a0d ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗