[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFcO6XOOjFd7XKuMVDyGXka+jdk3=RXFAe2a11SV20_JZzYHqw@mail.gmail.com>
Date: Sat, 8 May 2021 00:24:11 +0800
From: butt3rflyh4ck <butterflyhuangxx@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel: f2fs: out-of-bounds memory access bug
The patch is for this issue in upstream linux:
https://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs.git/commit/?h=dev&id=b862676e371715456c9dade7990c8004996d0d9e
Regards,
butt3rflyh4ck.
On Mon, Mar 29, 2021 at 12:00 AM butt3rflyh4ck
<butterflyhuangxx@...il.com> wrote:
>
> Hi,
>
> I reported an out of bounds memory access bug in get_next_net_page()
> in fs/f2fs/node.c and reproduce in 5.12.0-rc3. Now the patch is out
> and tested it in 5.12.0-rc4.
>
> Root Cause:
> the f2fs_flush_nat_entries() function is called during the
> checkpointing process,
> when it flush dirty nats in nat entry sets, it will call
> __flush_nat_entry_set(), but before call it,the legality of nids is
> not correctly tested. If the nids is out of range, may access
> out-of-bounds memory.
>
> Some details and Patch for this issue:
> https://www.mail-archive.com/linux-kernel@vger.kernel.org/msg2520013.html
> Now the patch is not available in upstream, CVE is not assigned.
>
> Now announced on oss-security@...ts.openwl.com.
>
> This issue was discovered by the ADLab of venustech.
>
> Regards,
> butt3rflyh4ck.
--
Active Defense Lab of Venustech
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
