linux-ext4 - [Bug 199869] use-after-free in ext4_journal_get_write_access() when mounting and operating a crafted ext4 image

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 14 Jun 2018 20:29:55 +0000
From:   bugzilla-daemon@...zilla.kernel.org
To:     linux-ext4@...nel.org
Subject: [Bug 199869] use-after-free in ext4_journal_get_write_access() when
 mounting and operating a crafted ext4 image

https://bugzilla.kernel.org/show_bug.cgi?id=199869

Theodore Tso (tytso@....edu) changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |tytso@....edu
         Resolution|---                         |DUPLICATE

--- Comment #2 from Theodore Tso (tytso@....edu) ---
This is a dup of #200001.   With "ext4: always verify the magic number in xattr
blocks" applied, I'm no longer seeing crashes and instead we get the following:

root@...-xfstests:~# /vdb/poc/do-869
[   82.775704] EXT4-fs (loop0): barriers disabled
[   82.778168] EXT4-fs (loop0): mounted filesystem with ordered data mode.
Opts: (null)
[   82.786417] EXT4-fs error (device loop0): ext4_get_branch:171: inode #14:
block 1048576: comm poc-199869: invalid block
[   82.790189] EXT4-fs error (device loop0): ext4_map_blocks:592: inode #14:
block 1048576: comm poc-199869: lblock 41 mapped to illegal pblock (length 1)
[   82.795350] EXT4-fs error (device loop0): ext4_clear_blocks:849: inode #14:
comm poc-199869: attempt to clear invalid blocks 1048576 len 1
[   82.811524] EXT4-fs error (device loop0): ext4_xattr_block_get:533: inode
#14: comm poc-199869: corrupted xattr block 97
[   82.813991] EXT4-fs error (device loop0): ext4_xattr_block_get:533: inode
#14: comm poc-199869: corrupted xattr block 97
[   82.817136] EXT4-fs error (device loop0): ext4_xattr_block_get:533: inode
#14: comm poc-199869: corrupted xattr block 97
[   82.819888] EXT4-fs error (device loop0): ext4_xattr_block_get:533: inode
#14: comm poc-199869: corrupted xattr block 97
[   82.822414] EXT4-fs error (device loop0): ext4_xattr_block_get:533: inode
#14: comm poc-199869: corrupted xattr block 97
[   82.824712] EXT4-fs error (device loop0): ext4_xattr_block_get:533: inode
#14: comm poc-199869: corrupted xattr block 97
[   82.826988] EXT4-fs error (device loop0): ext4_xattr_block_get:533: inode
#14: comm poc-199869: corrupted xattr block 97
[   82.829463] EXT4-fs warning (device loop0): ext4_evict_inode:302: xattr
delete (err -117)

*** This bug has been marked as a duplicate of bug 200001 ***

-- 
You are receiving this mail because:
You are watching the assignee of the bug.