CVSS 7.8 · High EPSS 0,19%
Kerentanan Out-of-bounds Write pada linux kernel, debian linux. Skor CVSS 3.1 7.8 (High) menurut NVD.
In the Linux kernel, the following vulnerability has been resolved: Squashfs: check return result of sb_min_blocksize Syzkaller reports an "UBSAN: shift-out-of-bounds in squashfs_bio_read" bug. Syzkaller forks multiple processes which after mounting the Squashfs filesystem, issues an ioctl("/dev/loop0", LOOP_SET_BLOCK_SIZE, 0x8000). Now if this ioctl occurs at the same time another process is in the process of mounting a Squashfs filesystem on /dev/loop0, the failure occurs. When this happens the following code in squashfs_fill_super() fails. ---- msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE); msblk->devblksize_log2 = ffz(~msblk->devblksize); ---- sb_min_blocksize() returns 0, which means msblk->devblksize is set to 0. As a result, ffz(~msblk->devblksize) returns 64, and msblk->devblksize_log2 is set to 64. This subsequently causes the UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195:36 shift exponent 64 is too large for 64-bit type 'u64' (aka 'unsigned long long') This commit adds a check for a 0 return by sb_min_blocksize().
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| linux | linux kernel | Versi 2.6.29 hingga sebelum 5.4.295 |
| linux | linux kernel | Versi 5.5 hingga sebelum 5.10.239 |
| linux | linux kernel | Versi 5.11 hingga sebelum 5.15.186 |
| linux | linux kernel | Versi 5.16 hingga sebelum 6.1.142 |
| linux | linux kernel | Versi 6.2 hingga sebelum 6.6.94 |
| linux | linux kernel | Versi 6.7 hingga sebelum 6.12.34 |
| linux | linux kernel | Versi 6.13 hingga sebelum 6.15.3 |
| debian | debian linux | Versi 11.0 |