In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() reads rs->cont_extent verbatim from the Rock Ridge CE record and passes it to sb_bread() without checking that the block number is within the mounted ISO 9660 volume. commit e595447e177b ("[PATCH] rock.c: handle corrupted directories") added cont_offset and cont_size rejection for the CE continuation but did not validate the extent block number itself. commit f54e18f1b831 ("isofs: Fix infinite looping over CE entries") later capped the CE chain length at RR_MAX_CE_ENTRIES = 32 but again left the block number unchecked. With a crafted ISO mounted via udisks2 (desktop optical auto-mount) or via CAP_SYS_ADMIN mount, rs->cont_extent can therefore point at an out-of-range block or at blocks belonging to an adjacent filesystem on the same block device. sb_bread() on an out-of-range block returns NULL cleanly via the block layer EIO path, so there is no memory-safety violation. For in-range reads of adjacent- filesystem data, the CE buffer is parsed as Rock Ridge records and only the text of SL sub-records reaches userspace through readlink(), which makes the info-leak channel narrow and difficult to exploit; still, rejecting the malformed CE outright matches the rejection shape already present in the same function for cont_offset and cont_size. Add an ISOFS_SB(sb)->s_nzones bounds check to rock_continue() next to the existing offset/size rejection, printing the same corrupted-directory-entry notice.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: isofs: validar la extensión de continuación Rock Ridge CE contra el tamaño del volumen rock_continue() lee rs->cont_extent textualmente del registro Rock Ridge CE y lo pasa a sb_bread() sin verificar que el número de bloque esté dentro del volumen ISO 9660 montado. El commit e595447e177b ('[PATCH] rock.c: handle corrupted directories') añadió el rechazo de cont_offset y cont_size para la continuación CE pero no validó el número de bloque de la extensión en sí. El commit f54e18f1b831 ('isofs: Fix infinite looping over CE entries') más tarde limitó la longitud de la cadena CE a RR_MAX_CE_ENTRIES = 32 pero de nuevo dejó el número de bloque sin verificar. Con un ISO manipulado montado vía udisks2 (montaje automático óptico de escritorio) o vía montaje CAP_SYS_ADMIN, rs->cont_extent puede, por lo tanto, apuntar a un bloque fuera de rango o a bloques pertenecientes a un sistema de archivos adyacente en el mismo dispositivo de bloques. sb_bread() en un bloque fuera de rango devuelve NULL limpiamente vía la ruta EIO de la capa de bloques, por lo que no hay violación de seguridad de memoria. Para lecturas dentro de rango de datos de sistemas de archivos adyacentes, el búfer CE se analiza como registros Rock Ridge y solo el texto de los subregistros SL llega al espacio de usuario a través de readlink(), lo que hace que el canal de fuga de información sea estrecho y difícil de exploit; aún así, rechazar el CE malformado directamente coincide con la forma de rechazo ya presente en la misma función para cont_offset y cont_size. Añadir una verificación de límites ISOFS_SB(sb)->s_nzones a rock_continue() junto al rechazo existente de offset/size, imprimiendo el mismo aviso de entrada de directorio corrupta.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | NONE |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | LOW |
| Availability Impact | NONE |
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Type: Secondary
Exploitability Score: 3.9
Impact Score: 4.2
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-401
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbea0c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23549fd240> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbeaac0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbeb300> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbe95c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbe90c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbe9900> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbe8280> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbe91c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbe8580> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbe8740> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbea300> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d239fbeb2c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7d23549fd0c0> | Operating System |
| linux | linux_kernel | 7.1 | <built-in method update of dict object at 0x7d23549fd440> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* |