Description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access The bounds check for the next xattr entry in check_xattrs() uses (void *)next >= end, which allows next to point within sizeof(u32) bytes of end. On the next loop iteration, IS_LAST_ENTRY() reads 4 bytes via *(__u32 *)(entry), which can overrun the valid xattr region. For example, if next lands at end - 1, the check passes since next < end, but IS_LAST_ENTRY() reads 4 bytes starting at end - 1, accessing 3 bytes beyond the valid region. Fix this by changing the check to (void *)next + sizeof(u32) > end, ensuring there is always enough space for the IS_LAST_ENTRY() read on the subsequent iteration.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3478c83cf26bbffd026ae6a56bcb1fe544f0834e to < ab6da97bc310db35d4e4ef5354bc3ff626b0698caffected3478c83cf26bbffd026ae6a56bcb1fe544f0834e to < 5a5314d2387633a272a04d1bd8727f99058e4e68affected3478c83cf26bbffd026ae6a56bcb1fe544f0834e to < 537e065977022aa22f2c2503e8accaf16622e0fdaffected3478c83cf26bbffd026ae6a56bcb1fe544f0834e to < 520986722dbf869c122252123fc161c7302eab7daffected3478c83cf26bbffd026ae6a56bcb1fe544f0834e to < eceafc31ea7b42c984ece10d79d505c0bb6615d5affected
Linux Linux
Default version status: affected
6.3affected0 to < 6.3unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ab6da97bc310db35d4e4ef5354bc3ff626b0698c ↗
- https://git.kernel.org/stable/c/5a5314d2387633a272a04d1bd8727f99058e4e68 ↗
- https://git.kernel.org/stable/c/537e065977022aa22f2c2503e8accaf16622e0fd ↗
- https://git.kernel.org/stable/c/520986722dbf869c122252123fc161c7302eab7d ↗
- https://git.kernel.org/stable/c/eceafc31ea7b42c984ece10d79d505c0bb6615d5 ↗