Description
In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image (COMP_OPTS flag is 1 but dictionary size is 0) is mounted, and performs shift operations using dictionarysize, the shift exponent is -1, causing a shift-out-of-bounds. Detail as below: squashfs_comp_opts(msblk, buffer, length) squashfs_xz_comp_opts() if (comp_opts) n = ffs(opts->dict_size) - 1;<----opts->dict_size=0, n=-1 if (opts->dict_size != (1 << n) && opts->dict_size != (1 << n) + (1 << (n + 1))) <----shift-out-of-bounds Fix it by adding a dictionary size range check before the shift operation.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
ff750311d30acc9564ef577050794953eee59f01 to < b02948a23455f8190a53887b2d2c13ae1d360ceaaffectedff750311d30acc9564ef577050794953eee59f01 to < 9d9c5c218ea356a1d88765214ad2919605280ab1affectedff750311d30acc9564ef577050794953eee59f01 to < 7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1affectedff750311d30acc9564ef577050794953eee59f01 to < c68e0068a236f9a7dfc19720bdf11e5d80a85089affectedff750311d30acc9564ef577050794953eee59f01 to < 88c673a0bd233df44ca0020da82f4fd3876de27aaffectedff750311d30acc9564ef577050794953eee59f01 to < 0cb85377daaefb4ce5ce72975f2deb27ee0e0cadaffectedff750311d30acc9564ef577050794953eee59f01 to < e1ca4e3a380ef3e8f46ce006f1146392e3f32c98affectedff750311d30acc9564ef577050794953eee59f01 to < 1f7745fb3580152ca902ef181b605f33cabfb1d0affected
Linux Linux
Default version status: affected
2.6.39affected0 to < 2.6.39unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.55 to ≤ 6.18.*unaffected7.2.9 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/b02948a23455f8190a53887b2d2c13ae1d360cea ↗
- https://git.kernel.org/stable/c/9d9c5c218ea356a1d88765214ad2919605280ab1 ↗
- https://git.kernel.org/stable/c/7a1c293e7aa17f1afaee0684e0e931fe23a5a6b1 ↗
- https://git.kernel.org/stable/c/c68e0068a236f9a7dfc19720bdf11e5d80a85089 ↗
- https://git.kernel.org/stable/c/88c673a0bd233df44ca0020da82f4fd3876de27a ↗
- https://git.kernel.org/stable/c/0cb85377daaefb4ce5ce72975f2deb27ee0e0cad ↗
- https://git.kernel.org/stable/c/e1ca4e3a380ef3e8f46ce006f1146392e3f32c98 ↗
- https://git.kernel.org/stable/c/1f7745fb3580152ca902ef181b605f33cabfb1d0 ↗