CVE-2024-56619
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry()
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required.
Reserved 2024-12-27 | Published 2024-12-27 | Updated 2025-01-20 | Assigner Linuxgit.kernel.org/...c/09d6d05579fd46e61abf6e457bb100ff11f3a9d3
git.kernel.org/...c/e3732102a9d638d8627d14fdf7b208462f0520e0
git.kernel.org/...c/48eb6e7404948032bbe811c5affbe39f6b316951
git.kernel.org/...c/5af8366625182f01f6d8465c9a3210574673af57
git.kernel.org/...c/c3afea07477baccdbdec4483f8d5e59d42a3f67f
git.kernel.org/...c/31f7b57a77d4c82a34ddcb6ff35b5aa577ef153e
git.kernel.org/...c/985ebec4ab0a28bb5910c3b1481a40fbf7f9e61d
Support options
