oss-security - Linux kernel: f2fs: out-of-bounds memory access bug

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFcO6XO2k=X2H24tg_GTgoTQMLv=0ajAyuyeK0YKgvqiM5vPWg@mail.gmail.com>
Date: Mon, 29 Mar 2021 00:00:30 +0800
From: butt3rflyh4ck <butterflyhuangxx@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux kernel: f2fs: out-of-bounds memory access bug

Hi,

I reported an out of bounds memory access bug in get_next_net_page()
in fs/f2fs/node.c and reproduce in 5.12.0-rc3. Now the patch is out
and tested it in 5.12.0-rc4.

Root Cause:
 the f2fs_flush_nat_entries()  function is called during the
checkpointing process,
when it flush dirty nats in nat entry sets, it will call
__flush_nat_entry_set(), but before call it,the legality of nids is
not correctly tested. If the nids is out of range, may access
out-of-bounds memory.

Some details and Patch for this issue:
https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2520013.html
Now the patch is not available in upstream, CVE is not assigned.

Now announced on oss-security@...ts.openwl.com.

This issue was discovered by the ADLab of venustech.

Regards,
 butt3rflyh4ck.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.