linux-cve-announce - CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024122738-CVE-2024-53234-4ee6@gregkh>
Date: Fri, 27 Dec 2024 14:53:20 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2024-53234: erofs: handle NONHEAD !delta[1] lclusters gracefully

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

erofs: handle NONHEAD !delta[1] lclusters gracefully

syzbot reported a WARNING in iomap_iter_done:
 iomap_fiemap+0x73b/0x9b0 fs/iomap/fiemap.c:80
 ioctl_fiemap fs/ioctl.c:220 [inline]

Generally, NONHEAD lclusters won't have delta[1]==0, except for crafted
images and filesystems created by pre-1.0 mkfs versions.

Previously, it would immediately bail out if delta[1]==0, which led to
inadequate decompressed lengths (thus FIEMAP is impacted).  Treat it as
delta[1]=1 to work around these legacy mkfs versions.

`lclusterbits > 14` is illegal for compact indexes, error out too.

The Linux kernel CVE team has assigned CVE-2024-53234 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.15 with commit d95ae5e25326092d61613acf98280270dde22778 and fixed in 6.6.64 with commit f466641debcbea8bdf78d1b63a6270aadf9301bf
	Issue introduced in 5.15 with commit d95ae5e25326092d61613acf98280270dde22778 and fixed in 6.11.11 with commit 480c6c7b55aeacac800bc2a0d321ff53273045e5
	Issue introduced in 5.15 with commit d95ae5e25326092d61613acf98280270dde22778 and fixed in 6.12.2 with commit daaf68fef4b2ff97928227630021d37b27a96655
	Issue introduced in 5.15 with commit d95ae5e25326092d61613acf98280270dde22778 and fixed in 6.13-rc1 with commit 0bc8061ffc733a0a246b8689b2d32a3e9204f43c
	Issue introduced in 5.4.251 with commit 96a85becb811ca2ce21a21721f1544d342ae431e
	Issue introduced in 5.10.188 with commit 8c723eef989bc419585237daa467b787ddca5415
	Issue introduced in 5.15.121 with commit 0e1854f87be8fa237198d407a1347476dbead3f5

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-53234
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/erofs/zmap.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f466641debcbea8bdf78d1b63a6270aadf9301bf
	https://git.kernel.org/stable/c/480c6c7b55aeacac800bc2a0d321ff53273045e5
	https://git.kernel.org/stable/c/daaf68fef4b2ff97928227630021d37b27a96655
	https://git.kernel.org/stable/c/0bc8061ffc733a0a246b8689b2d32a3e9204f43c