In the Linux kernel, the following vulnerability has been resolved:
exfat: check if cluster num is valid
Syzbot reported slab-out-of-bounds read in exfatclearbitmap. This was triggered by reproducer calling truncute with size 0, which causes the following trace:
BUG: KASAN: slab-out-of-bounds in exfatclearbitmap+0x147/0x490 fs/exfat/balloc.c:174 Read of size 8 at addr ffff888115aa9508 by task syz-executor251/365
Call Trace: _dumpstack lib/dumpstack.c:77 [inline] dumpstacklvl+0x1e2/0x24b lib/dumpstack.c:118 printaddressdescription+0x81/0x3c0 mm/kasan/report.c:233 _kasanreport mm/kasan/report.c:419 [inline] kasanreport+0x1a4/0x1f0 mm/kasan/report.c:436 _asanreportload8noabort+0x14/0x20 mm/kasan/reportgeneric.c:309 exfatclearbitmap+0x147/0x490 fs/exfat/balloc.c:174 exfatfreecluster+0x25a/0x4a0 fs/exfat/fatent.c:181 _exfattruncate+0x99e/0xe00 fs/exfat/file.c:217 exfattruncate+0x11b/0x4f0 fs/exfat/file.c:243 exfatsetattr+0xa03/0xd40 fs/exfat/file.c:339 notifychange+0xb76/0xe10 fs/attr.c:336 dotruncate+0x1ea/0x2d0 fs/open.c:65
Move the isvalidcluster() helper from fatent.c to a common header to make it reusable in other *.c files. And add isvalidcluster() to validate if cluster number is within valid range in exfatclearbitmap() and exfatsetbitmap().
[
{
"id": "CVE-2022-49560-02a010e0",
"target": {
"file": "fs/exfat/exfat_fs.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c504167adc3248095a905fa0700a9693897cb5ed",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34743881943219799512808312442441223651",
"186863364181357850087099275540989561287",
"301803991320815759581063656195278751290"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-0dceee86",
"target": {
"function": "exfat_clear_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f723b8a5adf497f9e34c702a30ca7298615654",
"signature_type": "Function",
"digest": {
"function_hash": "192168579648126260934230763057818030034",
"length": 701.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-11f67c74",
"target": {
"file": "fs/exfat/fatent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f723b8a5adf497f9e34c702a30ca7298615654",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300562545408707719986302434601699776255",
"302212570377464923894279619355664732197",
"126873296902039056688217055490026964275",
"78357766719670372293479157364056638366",
"17796329829000418717236459911858540541",
"234169472630012950605169388319931630549",
"212740958847547843202171738590101856817",
"116781709858057518997132551723407398375",
"212715217275675268443395956895431616582",
"26043358432727613854509846995364549352"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-15053627",
"target": {
"function": "exfat_set_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2193286402df2d9c53294f7a858d5e6fd7346e08",
"signature_type": "Function",
"digest": {
"function_hash": "70447499374572212195950458972416979005",
"length": 420.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-15a9a2d9",
"target": {
"function": "exfat_set_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d",
"signature_type": "Function",
"digest": {
"function_hash": "70447499374572212195950458972416979005",
"length": 420.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-3b7532b4",
"target": {
"function": "exfat_set_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c58b14b6f9cde9f69e7fa053ab73f6e013a7131",
"signature_type": "Function",
"digest": {
"function_hash": "70447499374572212195950458972416979005",
"length": 420.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-3ebae11f",
"target": {
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c504167adc3248095a905fa0700a9693897cb5ed",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338014907655188808185807030914386386175",
"311045266635057826625213779717976563222",
"102394388835917503723997566049589778699",
"19147944137920836540483591669310528526",
"271153161557650775223183177868878670514",
"185233854997995030916157222297714168239",
"334791522936671571068540689434843408629",
"19147944137920836540483591669310528526"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-4914036c",
"target": {
"file": "fs/exfat/fatent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c504167adc3248095a905fa0700a9693897cb5ed",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300562545408707719986302434601699776255",
"302212570377464923894279619355664732197",
"126873296902039056688217055490026964275",
"78357766719670372293479157364056638366",
"17796329829000418717236459911858540541",
"234169472630012950605169388319931630549",
"212740958847547843202171738590101856817",
"116781709858057518997132551723407398375",
"212715217275675268443395956895431616582",
"26043358432727613854509846995364549352"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-49b7bf4e",
"target": {
"file": "fs/exfat/fatent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c58b14b6f9cde9f69e7fa053ab73f6e013a7131",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300562545408707719986302434601699776255",
"302212570377464923894279619355664732197",
"126873296902039056688217055490026964275",
"27467447540476722834416675633572213484",
"29035263064433156771664154294576687909",
"320379944802331336643175459763657166597",
"138164397019301730084235046902592843431",
"26043358432727613854509846995364549352"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-54671754",
"target": {
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f723b8a5adf497f9e34c702a30ca7298615654",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338014907655188808185807030914386386175",
"311045266635057826625213779717976563222",
"102394388835917503723997566049589778699",
"19147944137920836540483591669310528526",
"271153161557650775223183177868878670514",
"185233854997995030916157222297714168239",
"334791522936671571068540689434843408629",
"19147944137920836540483591669310528526"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-5a11d035",
"target": {
"function": "exfat_set_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c504167adc3248095a905fa0700a9693897cb5ed",
"signature_type": "Function",
"digest": {
"function_hash": "70447499374572212195950458972416979005",
"length": 420.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-71526ad5",
"target": {
"file": "fs/exfat/exfat_fs.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2193286402df2d9c53294f7a858d5e6fd7346e08",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34743881943219799512808312442441223651",
"186863364181357850087099275540989561287",
"301803991320815759581063656195278751290"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-7ec4c678",
"target": {
"function": "exfat_clear_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2193286402df2d9c53294f7a858d5e6fd7346e08",
"signature_type": "Function",
"digest": {
"function_hash": "309902405532938304270362838770718259412",
"length": 702.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-81af4939",
"target": {
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2193286402df2d9c53294f7a858d5e6fd7346e08",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338014907655188808185807030914386386175",
"311045266635057826625213779717976563222",
"102394388835917503723997566049589778699",
"19147944137920836540483591669310528526",
"271153161557650775223183177868878670514",
"185233854997995030916157222297714168239",
"334791522936671571068540689434843408629",
"19147944137920836540483591669310528526"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-836c826e",
"target": {
"function": "exfat_clear_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d",
"signature_type": "Function",
"digest": {
"function_hash": "309902405532938304270362838770718259412",
"length": 702.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-9eb3a183",
"target": {
"file": "fs/exfat/exfat_fs.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c58b14b6f9cde9f69e7fa053ab73f6e013a7131",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34743881943219799512808312442441223651",
"186863364181357850087099275540989561287",
"301803991320815759581063656195278751290"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-a0ba27a8",
"target": {
"function": "exfat_set_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f723b8a5adf497f9e34c702a30ca7298615654",
"signature_type": "Function",
"digest": {
"function_hash": "203913412098474897795480176069293745760",
"length": 419.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-a9d2bbf6",
"target": {
"file": "fs/exfat/exfat_fs.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34743881943219799512808312442441223651",
"186863364181357850087099275540989561287",
"301803991320815759581063656195278751290"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-aaef719d",
"target": {
"function": "exfat_clear_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c58b14b6f9cde9f69e7fa053ab73f6e013a7131",
"signature_type": "Function",
"digest": {
"function_hash": "309902405532938304270362838770718259412",
"length": 702.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-b65239b2",
"target": {
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7c58b14b6f9cde9f69e7fa053ab73f6e013a7131",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338014907655188808185807030914386386175",
"311045266635057826625213779717976563222",
"102394388835917503723997566049589778699",
"19147944137920836540483591669310528526",
"271153161557650775223183177868878670514",
"185233854997995030916157222297714168239",
"334791522936671571068540689434843408629",
"19147944137920836540483591669310528526"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-b65de706",
"target": {
"function": "exfat_clear_bitmap",
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c504167adc3248095a905fa0700a9693897cb5ed",
"signature_type": "Function",
"digest": {
"function_hash": "309902405532938304270362838770718259412",
"length": 702.0
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-be16386b",
"target": {
"file": "fs/exfat/balloc.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338014907655188808185807030914386386175",
"311045266635057826625213779717976563222",
"102394388835917503723997566049589778699",
"19147944137920836540483591669310528526",
"271153161557650775223183177868878670514",
"185233854997995030916157222297714168239",
"334791522936671571068540689434843408629",
"19147944137920836540483591669310528526"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-ec692525",
"target": {
"file": "fs/exfat/exfat_fs.h"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@82f723b8a5adf497f9e34c702a30ca7298615654",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"34743881943219799512808312442441223651",
"186863364181357850087099275540989561287",
"301803991320815759581063656195278751290"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-ee7b5f81",
"target": {
"file": "fs/exfat/fatent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@64ba4b15e5c045f8b746c6da5fc9be9a6b00b61d",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300562545408707719986302434601699776255",
"302212570377464923894279619355664732197",
"126873296902039056688217055490026964275",
"27467447540476722834416675633572213484",
"29035263064433156771664154294576687909",
"320379944802331336643175459763657166597",
"138164397019301730084235046902592843431",
"26043358432727613854509846995364549352"
]
},
"deprecated": false,
"signature_version": "v1"
},
{
"id": "CVE-2022-49560-efe1e224",
"target": {
"file": "fs/exfat/fatent.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2193286402df2d9c53294f7a858d5e6fd7346e08",
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"300562545408707719986302434601699776255",
"302212570377464923894279619355664732197",
"126873296902039056688217055490026964275",
"27467447540476722834416675633572213484",
"29035263064433156771664154294576687909",
"320379944802331336643175459763657166597",
"138164397019301730084235046902592843431",
"26043358432727613854509846995364549352"
]
},
"deprecated": false,
"signature_version": "v1"
}
]