Description
In the Linux kernel, the following vulnerability has been resolved: orangefs: keep the readdir entry size 64-bit in fill_from_part() fill_from_part() computes the size of a directory entry in size_t but stores it in a __u32. An entry length near U32_MAX wraps it to a small value, bypasses the bounds check, and is then used to index the entry, reading far past the directory part -- an out-of-bounds read that oopses the kernel. Compute the size as a u64 so it cannot truncate; the bounds check then rejects the entry. The trailer is supplied by the userspace client.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
480e3e532e31666a18520a7964bb4095d7a16b9a to < 1679780f482feeb82acb5995587d4fb1d1fe82fdaffected480e3e532e31666a18520a7964bb4095d7a16b9a to < a72bbb43689591c9d36e3bb45c2d4e688cf92682affected480e3e532e31666a18520a7964bb4095d7a16b9a to < 36723b28e3293047f087f4501f1ef4ead418dd84affected480e3e532e31666a18520a7964bb4095d7a16b9a to < 07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9affected480e3e532e31666a18520a7964bb4095d7a16b9a to < fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1affected480e3e532e31666a18520a7964bb4095d7a16b9a to < 82fc886e244c76fadf05ef1958aaf8815478ccdeaffected480e3e532e31666a18520a7964bb4095d7a16b9a to < e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729affected480e3e532e31666a18520a7964bb4095d7a16b9a to < 18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfcaffected
Linux Linux
Default version status: affected
4.12affected0 to < 4.12unaffected5.10.261 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/1679780f482feeb82acb5995587d4fb1d1fe82fd ↗
- https://git.kernel.org/stable/c/a72bbb43689591c9d36e3bb45c2d4e688cf92682 ↗
- https://git.kernel.org/stable/c/36723b28e3293047f087f4501f1ef4ead418dd84 ↗
- https://git.kernel.org/stable/c/07c05601a9a8e5d4481b2a4a16dc0e3c5bc63ad9 ↗
- https://git.kernel.org/stable/c/fdf06a1b66ff39664b01c6bb6a2aa98d81e8ebe1 ↗
- https://git.kernel.org/stable/c/82fc886e244c76fadf05ef1958aaf8815478ccde ↗
- https://git.kernel.org/stable/c/e3d325c0bdb7bc5d1b4cc8d8441d79794cd03729 ↗
- https://git.kernel.org/stable/c/18227a6bc98bd0ba96ed3ce9d5b28776a5a28dfc ↗