Description
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix slab-out-of-bounds read in DeleteIndexEntryRoot In the 'DeleteIndexEntryRoot' case of the 'do_action' function, the entry size ('esize') is retrieved from the log record without adequate bounds checking. Specifically, the code calculates the end of the entry ('e2') using: e2 = Add2Ptr(e1, esize); It then calculates the size for memmove using 'PtrOffset(e2, ...)', which subtracts the end pointer from the buffer limit. If 'esize' is maliciously large, 'e2' exceeds the used buffer size. This results in a negative offset which, when cast to size_t for memmove, interprets as a massive unsigned integer, leading to a heap buffer overflow. This commit adds a check to ensure that the entry size ('esize') strictly fits within the remaining used space of the index header before performing memory operations.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
b46acd6a6a627d876898e1c84d3f84902264b445 to < 36c03f7f177b34d51f1cf1d2304b1074607bf4b0affectedb46acd6a6a627d876898e1c84d3f84902264b445 to < b271c9cb85927210b1b799e55ee7f702d12b4336affectedb46acd6a6a627d876898e1c84d3f84902264b445 to < a584b9d1059b29e97e17c919274e9adfb846f2a0affectedb46acd6a6a627d876898e1c84d3f84902264b445 to < c065541b71b79874c83d418a9acd18ad5826339baffectedb46acd6a6a627d876898e1c84d3f84902264b445 to < 78942172d5bff4d4afed8674abc09cc560ce44a0affectedb46acd6a6a627d876898e1c84d3f84902264b445 to < f3b437a4c3e022a1449658ae9f3dd34859894513affectedb46acd6a6a627d876898e1c84d3f84902264b445 to < b2bc7c44ed1779fc9eaab9a186db0f0d01439622affected
Linux Linux
Default version status: affected
5.15affected0 to < 5.15unaffected5.15.202 to ≤ 5.15.*unaffected6.1.165 to ≤ 6.1.*unaffected6.6.128 to ≤ 6.6.*unaffected6.12.75 to ≤ 6.12.*unaffected6.18.14 to ≤ 6.18.*unaffected6.19.4 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/36c03f7f177b34d51f1cf1d2304b1074607bf4b0 ↗
- https://git.kernel.org/stable/c/b271c9cb85927210b1b799e55ee7f702d12b4336 ↗
- https://git.kernel.org/stable/c/a584b9d1059b29e97e17c919274e9adfb846f2a0 ↗
- https://git.kernel.org/stable/c/c065541b71b79874c83d418a9acd18ad5826339b ↗
- https://git.kernel.org/stable/c/78942172d5bff4d4afed8674abc09cc560ce44a0 ↗
- https://git.kernel.org/stable/c/f3b437a4c3e022a1449658ae9f3dd34859894513 ↗
- https://git.kernel.org/stable/c/b2bc7c44ed1779fc9eaab9a186db0f0d01439622 ↗