CVSS 7.8 · High EPSS 0,21%
Kerentanan Use After Free pada linux kernel. Skor CVSS 3.1 7.8 (High) menurut CISA ADP.
In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential out-of-bounds memory access in nilfs_find_entry() Syzbot reported that when searching for records in a directory where the inode's i_size is corrupted and has a large value, memory access outside the folio/page range may occur, or a use-after-free bug may be detected if KASAN is enabled. This is because nilfs_last_byte(), which is called by nilfs_find_entry() and others to calculate the number of valid bytes of directory data in a page from i_size and the page index, loses the upper 32 bits of the 64-bit size information due to an inappropriate type of local variable to which the i_size value is assigned. This caused a large byte offset value due to underflow in the end address calculation in the calling nilfs_find_entry(), resulting in memory access that exceeds the folio/page size. Fix this issue by changing the type of the local variable causing the bit loss from "unsigned int" to "u64". The return value of nilfs_last_byte() is also of type "unsigned int", but it is truncated so as not to exceed PAGE_SIZE and no bit loss occurs, so no change is required.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 2.6.30 hingga sebelum 5.4.287 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.231 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.174 |
| linux | linux kernel | Versi 5.16 hingga sebelum 6.1.120 |
| linux | linux kernel | Versi 6.2 hingga 6.6.66 |
| linux | linux kernel | Versi 6.7 hingga 6.12.5 |
| linux | linux kernel | Versi 6.13 rc1 |