In the Linux kernel, the following vulnerability has been resolved:
ntfs: check overflow when iterating ATTR_RECORDs
Kernel iterates over ATTRRECORDs in mft record in ntfsattrfind(). Because the ATTRRECORDs are next to each other, kernel can get the next ATTRRECORD from end address of current ATTRRECORD, through current ATTR_RECORD length field.
The problem is that during iteration, when kernel calculates the end
address of current ATTR_RECORD, kernel may trigger an integer overflow bug
in executing a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length)). This
may wrap, leading to a forever iteration on 32bit systems.
This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45683723f6b53e39e8a4cec0894e61fd6ec71989",
"id": "CVE-2022-49762-0a14ba51",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63095f4f3af59322bea984a6ae44337439348fe0",
"id": "CVE-2022-49762-102fe719",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86f36de14dce5802856bb7a5921d74439db00b64",
"id": "CVE-2022-49762-144cfb80",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5559eb5809353a83a40a1e4e7f066431c7b83020",
"id": "CVE-2022-49762-3d9460a7",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@957732a09c3828267c2819d31c425aa793dd475b",
"id": "CVE-2022-49762-3fc2b342",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@957732a09c3828267c2819d31c425aa793dd475b",
"id": "CVE-2022-49762-74284005",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b63ddb3ba61e2d3539f87e095c881e552bc45dab",
"id": "CVE-2022-49762-7b080d86",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@86f36de14dce5802856bb7a5921d74439db00b64",
"id": "CVE-2022-49762-8abca349",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b63ddb3ba61e2d3539f87e095c881e552bc45dab",
"id": "CVE-2022-49762-9c43b1df",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b612f924f296408d7d02fb4cd01218afd4ed7184",
"id": "CVE-2022-49762-a3b10cb7",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63095f4f3af59322bea984a6ae44337439348fe0",
"id": "CVE-2022-49762-ae1611b4",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@785b2af9654b8beac55644e36da0085c5d776361",
"id": "CVE-2022-49762-b4ad530d",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b612f924f296408d7d02fb4cd01218afd4ed7184",
"id": "CVE-2022-49762-ce19c0ab",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5559eb5809353a83a40a1e4e7f066431c7b83020",
"id": "CVE-2022-49762-dcd5b896",
"deprecated": false,
"target": {
"function": "ntfs_attr_find",
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"length": 2312.0,
"function_hash": "268788878440453712206331861998931744965"
},
"signature_type": "Function"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@785b2af9654b8beac55644e36da0085c5d776361",
"id": "CVE-2022-49762-fb9203eb",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@45683723f6b53e39e8a4cec0894e61fd6ec71989",
"id": "CVE-2022-49762-fd3116e5",
"deprecated": false,
"target": {
"file": "fs/ntfs/attrib.c"
},
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"2357516575089754483873827648109489662",
"329774474826220768035869930459059245328",
"289338297897619860999056356385066928225",
"99909275972952700337623776594842930681"
]
},
"signature_type": "Line"
}
]