Lei Lu

لم تكن الدالة `nfsd4 setclientid confirm()` تتحقق من قيمة الإرجاع لـ `get client locked()`. قد تدخل عملية `SETCLIENTID CONFIRM` في حالة تضارب مع انتهاء صلاحية عميل مؤكد، مما يؤدي إلى فشل الحصول على مرجع ويؤدي محتملًا إلى حالة «الاستخدام بعد التحرير» (UAF). تم إصلاح المشكلة عن طريق الحصول على مرجع مسبقًا في حالة وجود عميل مؤكد ومعالجة الأخطاء بشكل مناسب.

The issue is related to the Linux kernel, where a vulnerability has been resolved by adding sanity checks for `xfs dir2 data unused` and `xfs dir2 data entry` to prevent accessing memory beyond valid regions. Before the patch, a crafted image could lead to an out-of-bounds read when accessing fixed members. The patch ensures that the remaining bytes are large enough to hold an unused entry or a dirent with a single-byte name before accessing these variables.

The issue is related to a lack of verification of the space occupied by fixed members of `xlog op header` in the `xlog recover process data` function. This can be exploited by creating a crafted image to trigger an out of bounds read. The exploitation involves several steps, including mounting an image of xfs, performing file operations, and modifying the image to simulate abnormal exit conditions. Technical details include modifying `xlog rec header->h num logops` and `xlog rec header->h crc` to create a vulnerable scenario. The estimated number of potentially affected devices and details about real-world incidents are not provided.

The issue is related to a function in the Linux kernel's NTFS3 file system module, specifically the `log replay()` function in `fs/ntfs3/fslog.c`, which is associated with reading memory beyond the allocated buffer. This could potentially impact the confidentiality and availability of protected information. The vulnerability has been resolved by adding checks for `attr names` and `oatbl` and implementing out-of-bound checking for `*ane` (ATTR NAME ENTRY) in the `fs/ntfs3` module.

The issue is related to a strict bound check before memcmp in the ocfs2 xattr find entry() function. The xattr in ocfs2 may be 'non-indexed', which is saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images. The vulnerability is associated with reading memory beyond the allocated buffer, which could allow an attacker to cause a denial of service.

The issue is related to the ocfs2 xattr find entry() function in the Linux kernel's ocfs2 file system module, which is vulnerable to out-of-bounds memory access. This could allow an attacker to impact the confidentiality, integrity, and availability of protected information. The vulnerability can be exploited by crafted images, and a paranoia check has been added to prevent out-of-bound access.

The issue is related to the btrfs file system in the Linux kernel. It was discovered that the kernel did not properly set the WRITTEN flag on all metadata blocks, which could lead to corruption on disk and out-of-bounds access. This was reported by KASAN as a wild-memory-access. The vulnerability was hit on a crafted image tweaking the WRITTEN bit.