Messages in this thread | | | Subject | Re: [PATCH] ntfs: Fix validity check for file name attribute | From | Desmond Cheong Zhi Xi <> | Date | Thu, 29 Jul 2021 19:56:09 +0800 |
| |
On 29/7/21 4:31 pm, Rolf Eike Beer wrote: > Hi, > > I was just scanning through some older vulnerabilities and came across > CVE-2018-12929, CVE-2018-12930, and CVE-2018-12931, which are all still open > according to linuxkernelcves.com (originally reported against 4.15 [1]). I > looked into the commits in fs/ntfs/ from 4.15 onwards to see if they were just > missed, but I can't spot anything there. RedHat claims to have them fixed in > one of their kernels [2]. > > Which makes me wonder if the issue fixed here is a duplicate of the any of the > above. Is there a reason I can't find any patches for the original issue in > tree, like the issue only introduced in a custom patchset that Ubuntu/RedHat > were using? Is this thing worth it's own CVE if it's no duplicate? > > Greetings, > > Eike > > 1) https://marc.info/?t=152407734400002&r=1&w=2 > 2) https://access.redhat.com/errata/RHSA-2019:0641 >
Hi Eike,
Thanks for digging into this. From a first glance, this bug seems most similar to CVE-2018-12929.
However, from the logs, the root causes are probably different. The cause of this bug is specifically in the call to ntfs_is_extended_system_file [1], but from what I can see this is not the case for CVE-2018-12929. I don't know enough to comment whether it needs a CVE, but it has been patched on Linux stable (up to 4.4).
It's worth noting that there's another similar bug that was fixed by Rustam Kovhaev (+cc) in ntfs_read_locked_inode [2]. This may or may not have been the issue in CVE-2018-12929.
Link: https://syzkaller.appspot.com/bug?id=a1a1e379b225812688566745c3e2f7242bffc246 [1]
Link: https://syzkaller.appspot.com/bug?id=933dab9c03ac47a3d09dd4b0563a0a8fcb35f282 [2]
Best wishes, Desmond
| |