Date: Mon, 04 Oct 2021 09:58:41 +0000 From: bugzilla-noreply@freebsd.org To: bugs@FreeBSD.org Subject: [Bug 258914] g_label_ntfs_taste() doesn't validate data read from disk, can generate wild pointers Message-ID: <bug-258914-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D258914 Bug ID: 258914 Summary: g_label_ntfs_taste() doesn't validate data read from disk, can generate wild pointers Product: Base System Version: CURRENT Hardware: Any OS: Any Status: New Severity: Affects Some People Priority: --- Component: kern Assignee: bugs@FreeBSD.org Reporter: rtm@lcs.mit.edu Created attachment 228428 --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=3D228428&action= =3Dedit Disk or USB memory stick image that causes an infinite loop in the kernel. g_label_ntfs_taste() in sys/geom/label/g_label_ntfs.c reads from newly inserted disks (e.g. USB memory sticks that may be corrupt or malicious) and uses the data without validation to form pointers, which it dereferences. filerecp =3D g_read_data(cp, voloff, recsize, NULL); fr =3D (struct ntfs_filerec *)filerecp; for (ap =3D filerecp + fr->fr_attroff; atr =3D (struct ntfs_attr *)ap, atr->a_type !=3D -1; ap +=3D atr->reclen) { Whoever created the disk image controls atr->reclen, and thus can control the value of pointer atr. I've attached a disk image whose atr->reclen is zero, and which will generate an infinite loop in the kernel. Other values of atr->reclen cause kernel page faults. --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-258914-227>