Description
In the Linux kernel, the following vulnerability has been resolved: xfs: validate attr entry pointer before field access xfs_attr3_leaf_verify_entry() accesses lentry/rentry fields (namelen, valuelen) before checking if the entry pointer itself is within bounds. If nameidx is crafted to point near the end of the buffer, these field accesses can read out-of-bounds before the bounds check at name_end > buf_end is performed. Add explicit bounds checks for entry pointers before accessing their fields. Use offsetof() to check that the start of the flexible array member (nameval/name) is within bounds, which ensures all preceding fields are safe to access.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
c84760659dcf237902d4cc997cd5f55cb3b2807f to < 0f82586741e39926542f621bafa424e237a04fa4affectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < 134d82a2b5e3eba3ebf58753a1387b22f26ca1deaffectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < 03a12253dd2a036545bdb0110a4e0b8dc70f8e7caffectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < e99120b5944a16d0bc27e52b33de78bcdaaabf5caffectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < 98a42bb9d60d42898c3494de351a1bf508348cdeaffectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < 184c1a80421a5b5ddcd262e47980ce2e67fee211affectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < 9f92e749fc08b7ff3d9da190c4d1b2273745b282affectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < c35da2bac6f7cb9a9be73f188b4fcc324615c327affectedc84760659dcf237902d4cc997cd5f55cb3b2807f to < b7eea80be25f3334f131d52982b3131aba77b97daffected
Linux Linux
Default version status: affected
5.5affected0 to < 5.5unaffected5.10.267 to ≤ 5.10.*unaffected5.15.218 to ≤ 5.15.*unaffected6.1.185 to ≤ 6.1.*unaffected6.6.154 to ≤ 6.6.*unaffected6.12.106 to ≤ 6.12.*unaffected6.18.47 to ≤ 6.18.*unaffected7.1.11 to ≤ 7.1.*unaffected7.2.1 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/0f82586741e39926542f621bafa424e237a04fa4 ↗
- https://git.kernel.org/stable/c/134d82a2b5e3eba3ebf58753a1387b22f26ca1de ↗
- https://git.kernel.org/stable/c/03a12253dd2a036545bdb0110a4e0b8dc70f8e7c ↗
- https://git.kernel.org/stable/c/e99120b5944a16d0bc27e52b33de78bcdaaabf5c ↗
- https://git.kernel.org/stable/c/98a42bb9d60d42898c3494de351a1bf508348cde ↗
- https://git.kernel.org/stable/c/184c1a80421a5b5ddcd262e47980ce2e67fee211 ↗
- https://git.kernel.org/stable/c/9f92e749fc08b7ff3d9da190c4d1b2273745b282 ↗
- https://git.kernel.org/stable/c/c35da2bac6f7cb9a9be73f188b4fcc324615c327 ↗
- https://git.kernel.org/stable/c/b7eea80be25f3334f131d52982b3131aba77b97d ↗