Description
In the Linux kernel, the following vulnerability has been resolved: ntfs: detect mapping-pairs LCN accumulator overflow The NTFS mapping-pairs parser accumulates relative LCN deltas in a signed integer. A corrupted attribute can drive that addition past the representable range. One corrupt runlist shape sets the accumulated LCN to S64_MAX and then adds a delta of 1 in the next mapping-pairs entry. Signed overflow is undefined and can turn an invalid runlist into a different set of physical clusters. Check the LCN addition for overflow before storing the next run.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b06b4fc2138ded8ee0b3dc602991ff6dbb10dd0aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 6626fb859f4c4772f2f59751d23937716e03f98faffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89affected1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 to < 7fb64788812d137b37f6d8724e1e41c624c1e814affected1e9ea7e04472d4e5e12e58c881eaacfb3e49b669 to < ec4f061f2219e0f0c6465d56d0380bf749235a53affected
Linux Linux
Default version status: affected
2.6.12affected7.1affected0 to < 2.6.12unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.9 to < 7.1unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b06b4fc2138ded8ee0b3dc602991ff6dbb10dd0a ↗
- https://git.kernel.org/stable/c/6626fb859f4c4772f2f59751d23937716e03f98f ↗
- https://git.kernel.org/stable/c/7ffa8f3d30236e0ab897c30bdb01224ff1fe1c89 ↗
- https://git.kernel.org/stable/c/7fb64788812d137b37f6d8724e1e41c624c1e814 ↗
- https://git.kernel.org/stable/c/ec4f061f2219e0f0c6465d56d0380bf749235a53 ↗