erofs: avoid infinite loops due to corrupted subpage compact indexes
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.160, 6.8, 6.12.91, 6.17.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: avoid infinite loops due to corrupted subpage compact indexes Robert reported an infinite loop observed by two crafted images. The root cause is that `clusterofs` can be larger than `lclustersize` for !NONHEAD `lclusters` in corrupted subpage compact indexes, e.g.: blocksize = lclustersize = 512 lcn = 6 clusterofs = 515 Move the corresponding check for full compress indexes to `z_erofs_load_lcluster_from_disk()` to also cover subpage compact compress indexes. It also fixes the position of `m->type >= Z_EROFS_LCLUSTER_TYPE_MAX` check, since it should be placed right after `z_erofs_load_{compact,full}_lcluster()`.
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From 3f691aa676f29586e83e6c032713554a290418c3 · fixed in b18a82503a67a530d48f5a5b429e162749fe2c89; From 8d2517aaeea3ab8651bb517bca8f3c8664d318ea · fixed in dbfac1b85d0753996ddfef636934d431b588dd1f; From 8d2517aaeea3ab8651bb517bca8f3c8664d318ea · fixed in 8675447a8794983f2b7e694b378112772c17635e; From 8d2517aaeea3ab8651bb517bca8f3c8664d318ea · fixed in e13d315ae077bb7c3c6027cc292401bc0f4ec683; From 6.6.16 · fixed in 6.6.160; From 6.7.4 · fixed in 6.8
- Linux Linux
6.8
- KernelLinux
fixed in 6.6.160; From 6.7.0 · fixed in 6.12.91; From 6.8.0 · fixed in 6.17.6