ghsa-5573-9qmv-c9ph
Vulnerability from github
Published
2025-05-01 15:31
Modified
2025-05-01 15:31
Details

In the Linux kernel, the following vulnerability has been resolved:

ntfs: check overflow when iterating ATTR_RECORDs

Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). Because the ATTR_RECORDs are next to each other, kernel can get the next ATTR_RECORD from end address of current ATTR_RECORD, through current ATTR_RECORD length field.

The problem is that during iteration, when kernel calculates the end address of current ATTR_RECORD, kernel may trigger an integer overflow bug in executing a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a->length)). This may wrap, leading to a forever iteration on 32bit systems.

This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.

Show details on source website

To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-49762"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-05-01T15:15:58Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nntfs: check overflow when iterating ATTR_RECORDs\n\nKernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). \nBecause the ATTR_RECORDs are next to each other, kernel can get the next\nATTR_RECORD from end address of current ATTR_RECORD, through current\nATTR_RECORD length field.\n\nThe problem is that during iteration, when kernel calculates the end\naddress of current ATTR_RECORD, kernel may trigger an integer overflow bug\nin executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a-\u003elength))`.  This\nmay wrap, leading to a forever iteration on 32bit systems.\n\nThis patch solves it by adding some checks on calculating end address\nof current ATTR_RECORD during iteration.",
  "id": "GHSA-5573-9qmv-c9ph",
  "modified": "2025-05-01T15:31:45Z",
  "published": "2025-05-01T15:31:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-49762"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/45683723f6b53e39e8a4cec0894e61fd6ec71989"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5559eb5809353a83a40a1e4e7f066431c7b83020"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63095f4f3af59322bea984a6ae44337439348fe0"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/785b2af9654b8beac55644e36da0085c5d776361"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/86f36de14dce5802856bb7a5921d74439db00b64"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/957732a09c3828267c2819d31c425aa793dd475b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b612f924f296408d7d02fb4cd01218afd4ed7184"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b63ddb3ba61e2d3539f87e095c881e552bc45dab"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.