In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against…
High CVSS 7.8
Summary
In the Linux kernel, the following vulnerability has been resolved: udf: validate free block extents against the partition length udf_free_blocks() checks the logical block number and count against the partition length, but drops the extent offset from that final bound. A crafted extent can pass the guard while logicalBlockNum + offset + count points past the partition, which later indexes past the space bitmap array. A single ftruncate(2) on a file backed by such an extent reliably panics …
In-depth triage
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/12af328d2ee8d68e81ba612246d0b54b22d23e1f
- https://git.kernel.org/stable/c/335202ab25b01fdd45889ff25eab70864686dea3
- https://git.kernel.org/stable/c/5f0419457f89dce1a3f1c8e62a3adf2f39ab8168
- https://git.kernel.org/stable/c/9442d75429b0c556292a7454fe888d54259f5240
- https://git.kernel.org/stable/c/b54aee5652fcd7c23a0904a4623ec462c3edc70c
- https://git.kernel.org/stable/c/be87de7789a82a030a4896bc7683415ec9fa6f2b
- https://git.kernel.org/stable/c/fb49099206c5c57af28a157249fa7bcb5518f99e
- https://git.kernel.org/stable/c/fdd6229d2ae9914c1f25d1041db0f4f312a4fa76
Timeline
- nvd_ingest NVD