linux-kernel - Re: [PATCH v2] ntfs: fix use-after-free in ntfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat,  9 Jul 2022 08:54:51 +0800
From:   Hawkins Jiawei <yin31149@...il.com>
To:     chenxiaosong2@...wei.com
Cc:     akpm@...ux-foundation.org, anton@...era.com,
        linux-kernel@...r.kernel.org, linux-ntfs-dev@...ts.sourceforge.net,
        liuyongqiang13@...wei.com, yi.zhang@...wei.com,
        zhangxiaoxu5@...wei.com, 18801353760@....com,
        skhan@...uxfoundation.org, paskripkin@...il.com,
        linux-kernel-mentees@...ts.linuxfoundation.org
Subject: Re: [PATCH v2] ntfs: fix use-after-free in ntfs_ucsncmp()

> Fix this by adding sanity check on end address of attibute name string.

> diff --git a/fs/ntfs/attrib.c b/fs/ntfs/attrib.c
> index 4de597a83b88..9ab8766872d2 100644
> --- a/fs/ntfs/attrib.c
> +++ b/fs/ntfs/attrib.c
> @@ -592,8 +592,12 @@ static int ntfs_attr_find(const ATTR_TYPE type, const ntfschar *name,
>  		a = (ATTR_RECORD*)((u8*)ctx->attr +
>  				le32_to_cpu(ctx->attr->length));
>  	for (;;	a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length))) {
> -		if ((u8*)a < (u8*)ctx->mrec || (u8*)a > (u8*)ctx->mrec +
> -				le32_to_cpu(ctx->mrec->bytes_allocated))
> +		u8 *mrec_end = (u8 *)ctx->mrec +
> +		               le32_to_cpu(ctx->mrec->bytes_allocated);
> +		u8 *name_end = (u8 *)a + le16_to_cpu(a->name_offset) +
> +		               a->name_length;

In my opinion, name_length field just means the number of characters,
yet each character is a ntfschar type. So name should be
name_length * sizeof(ntfschar) bytes. The example is at
https://elixir.bootlin.com/linux/v5.19-rc5/source/fs/ntfs/attrib.c#L1667

> +		if ((u8*)a < (u8*)ctx->mrec || (u8*)a > mrec_end ||
> +		    name_end > mrec_end)
>  			break;
>  		ctx->attr = a;
>  		if (unlikely(le32_to_cpu(a->type) > le32_to_cpu(type) ||
> --