| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <2024122709-CVE-2024-56619-501d@gregkh> Date: Fri, 27 Dec 2024 15:51:26 +0100 From: Greg Kroah-Hartman <gregkh@...uxfoundation.org> To: linux-cve-announce@...r.kernel.org Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org> Subject: CVE-2024-56619: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Description =========== In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required. The Linux kernel CVE team has assigned CVE-2024-56619 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.30 with commit 2ba466d74ed74f073257f86e61519cb8f8f46184 and fixed in 5.4.287 with commit 09d6d05579fd46e61abf6e457bb100ff11f3a9d3 Issue introduced in 2.6.30 with commit 2ba466d74ed74f073257f86e61519cb8f8f46184 and fixed in 5.10.231 with commit e3732102a9d638d8627d14fdf7b208462f0520e0 Issue introduced in 2.6.30 with commit 2ba466d74ed74f073257f86e61519cb8f8f46184 and fixed in 5.15.174 with commit 48eb6e7404948032bbe811c5affbe39f6b316951 Issue introduced in 2.6.30 with commit 2ba466d74ed74f073257f86e61519cb8f8f46184 and fixed in 6.1.120 with commit 5af8366625182f01f6d8465c9a3210574673af57 Issue introduced in 2.6.30 with commit 2ba466d74ed74f073257f86e61519cb8f8f46184 and fixed in 6.6.66 with commit c3afea07477baccdbdec4483f8d5e59d42a3f67f Issue introduced in 2.6.30 with commit 2ba466d74ed74f073257f86e61519cb8f8f46184 and fixed in 6.12.5 with commit 31f7b57a77d4c82a34ddcb6ff35b5aa577ef153e Issue introduced in 2.6.30 with commit 2ba466d74ed74f073257f86e61519cb8f8f46184 and fixed in 6.13-rc2 with commit 985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2024-56619 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/nilfs2/dir.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/09d6d05579fd46e61abf6e457bb100ff11f3a9d3 https://git.kernel.org/stable/c/e3732102a9d638d8627d14fdf7b208462f0520e0 https://git.kernel.org/stable/c/48eb6e7404948032bbe811c5affbe39f6b316951 https://git.kernel.org/stable/c/5af8366625182f01f6d8465c9a3210574673af57 https://git.kernel.org/stable/c/c3afea07477baccdbdec4483f8d5e59d42a3f67f https://git.kernel.org/stable/c/31f7b57a77d4c82a34ddcb6ff35b5aa577ef153e https://git.kernel.org/stable/c/985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d
Powered by blists - more mailing lists