Description
In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udf_read_tagged() skips CRC verification when descCRCLength + sizeof(struct tag) exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC validation entirely; the descriptor is then accepted based solely on the 8-bit tag checksum, which is trivially recomputable. Reject such descriptors instead of silently accepting them. A legitimate single-block descriptor should never have a CRC length that exceeds the block.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 832ab4a882dc9b3c0155490d9993642ef545fd22affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7d1b6adbf90df6c8941090d5646fbeca25ba9770affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 3dede76d525919bb966f9213e131af685de5ff99affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 50dfaf4a027742b4fcdc3e9305e7199ece9bc6a6affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 31605bbe94557bff721eaf041001169d44ac6f98affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 1873eb81c65d3f849418d7386baa39c439c9fc38affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < fdb26e628d2a211a23815d375bd33bdf863344e2affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 55d41b0a20128e86b9e960dd2e3f0a2d69a18df7affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.88 to ≤ 6.12.*unaffected6.18.30 to ≤ 6.18.*unaffected7.0.7 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/832ab4a882dc9b3c0155490d9993642ef545fd22 ↗
- https://git.kernel.org/stable/c/7d1b6adbf90df6c8941090d5646fbeca25ba9770 ↗
- https://git.kernel.org/stable/c/3dede76d525919bb966f9213e131af685de5ff99 ↗
- https://git.kernel.org/stable/c/50dfaf4a027742b4fcdc3e9305e7199ece9bc6a6 ↗
- https://git.kernel.org/stable/c/31605bbe94557bff721eaf041001169d44ac6f98 ↗
- https://git.kernel.org/stable/c/1873eb81c65d3f849418d7386baa39c439c9fc38 ↗
- https://git.kernel.org/stable/c/fdb26e628d2a211a23815d375bd33bdf863344e2 ↗
- https://git.kernel.org/stable/c/55d41b0a20128e86b9e960dd2e3f0a2d69a18df7 ↗