Description
In the Linux kernel, the following vulnerability has been resolved: fs/adfs: validate nzones in adfs_validate_bblk() Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used. When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...) which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer. adfs_validate_dr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfs_validate_bblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time. Found by syzkaller.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < 33aafd2418a59c96c0389d47ea09026661fa9ec6affectedf6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < 1f0ed0f57f0fc87e46fe19a05435c214dc464be2affectedf6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < 6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebcaffectedf6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < a11372a8b1ceaa5e950a84b3b5fbf8228f25e277affectedf6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < 1586bd2d2fb436a26df20a70e78b000d34a7d159affectedf6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < a3fd5dc1c7b0aae947a67dc2e2c037d57557a4deaffectedf6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < 60d82592ac8b5637fbed871381eb0a16df0a492eaffectedf6f14a0d71b0773a1d4147d1a3c33d537cd213ab to < dd9d3e16c2d5fa166e13dce07413be51f42c8f5daffected
Linux Linux
Default version status: affected
5.6affected0 to < 5.6unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.141 to ≤ 6.6.*unaffected6.12.91 to ≤ 6.12.*unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/33aafd2418a59c96c0389d47ea09026661fa9ec6 ↗
- https://git.kernel.org/stable/c/1f0ed0f57f0fc87e46fe19a05435c214dc464be2 ↗
- https://git.kernel.org/stable/c/6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebc ↗
- https://git.kernel.org/stable/c/a11372a8b1ceaa5e950a84b3b5fbf8228f25e277 ↗
- https://git.kernel.org/stable/c/1586bd2d2fb436a26df20a70e78b000d34a7d159 ↗
- https://git.kernel.org/stable/c/a3fd5dc1c7b0aae947a67dc2e2c037d57557a4de ↗
- https://git.kernel.org/stable/c/60d82592ac8b5637fbed871381eb0a16df0a492e ↗
- https://git.kernel.org/stable/c/dd9d3e16c2d5fa166e13dce07413be51f42c8f5d ↗