Към съдържанието
Търсене

CVE-2026-89493: Linux

8.8

CVSS 3.1

Няма данни

Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)

Няма потвърждение

Атакува се

Няма данни

Време до експлоатация

Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.

    Описание

    Оригинално описание

    In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array with: for (; i < le16_to_cpu(rb->rf_records.rl_used); i++) { rec = &rb->rf_records.rl_recs[i]; ... rl_recs[] lives in a single metadata block (4096 bytes on the common configuration), so its real capacity is fixed by ocfs2_refcount_recs_per_rb(sb) (247 records for a 4K block with the 16-byte ocfs2_refcount_rec). rl_used and rl_count are both read directly off disk by ocfs2_validate_refcount_block() and are never checked against that capacity, nor against each other, before any refcount/reflink/CoW operation walks the array. A crafted (or corrupted) refcount block with rl_used == 0xffff makes the loop above walk far past the end of the block, dereferencing rl_recs[i] for i up to 65534. The resulting index is then handed to the sibling ocfs2_insert_refcount_rec(), whose insert-shift does: if (index < le16_to_cpu(rf_list->rl_used)) memmove(&rf_list->rl_recs[index + 1], &rf_list->rl_recs[index], (le16_to_cpu(rf_list->rl_used) - index) * sizeof(struct ocfs2_refcount_rec)); i.e. a memmove() of up to (0xffff - index) * 16 bytes (~1 MiB) from an offset already past the block. This is reachable from an ordinary reflink (FICLONE) against a crafted/corrupted ocfs2 image: attaching an extent whose cpos sorts past every real record in the leaf forces the lookup to run off the end instead of returning early on a match. The attacker model is local: CAP_SYS_ADMIN mounting a crafted or corrupted ocfs2 image, or a raw write to the block device backing an already-mounted ocfs2 filesystem. ocfs2_validate_refcount_block() already validates the block's ECC, signature, rf_blkno and rf_fs_generation, but never rl_count/rl_used against the block's actual on-disk capacity. This is the same class of gap that ocfs2_validate_extent_block() (fs/ocfs2/alloc.c)

    Засегнати продукти

    • Linux Linux: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди f882e9e32d017a6569b2996c63ba3864717788e6; f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди 5593b63028cb43a6cda75a65ce1db95f00ea6857; f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди c8b02f4ee91e757b3fff556c7168b24b7ae55132; f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди 97584e93fc49a2d59252ac60467e9279f11b1b5b; f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди af56e90cb546cb0c47bef059335365283f61d6a4; f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди 0761d2c9494424469a0d30a9da3496ca010b0b2d; f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди 04ead708e13ddcb9c39319cbe02a18cef99cb823; f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 преди 4ca62df6bc0708947b48da3f6a712ecb8e73929c
    • Linux Linux: 2.6.32; преди 2.6.32; 5.10.270 до 5.10.*; 5.15.221 до 5.15.*; 6.1.188 до 6.1.*; 6.6.157 до 6.6.*; 6.12.109 до 6.12.*; 6.18.50 до 6.18.*; 7.2.4 до 7.2.*; от 7.3 нататък

    История

    • 11 септември 2026 Публикувано

    Други уязвимости в Linux Linux

    Първоизточници

    CVE-2026-89493: Linux | freedomonline.bg