mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-06-01 11:11:27 +00:00
33 lines
2.5 KiB
JSON
33 lines
2.5 KiB
JSON
|
{
|
||
|
|
"id": "CVE-2024-50250",
|
||
|
|
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
||
|
|
"published": "2024-11-09T11:15:10.833",
|
||
|
|
"lastModified": "2024-11-09T11:15:10.833",
|
||
|
|
"vulnStatus": "Received",
|
||
|
|
"cveTags": [],
|
||
|
|
"descriptions": [
|
||
|
|
{
|
||
|
|
"lang": "en",
|
||
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfsdax: dax_unshare_iter needs to copy entire blocks\n\nThe code that copies data from srcmap to iomap in dax_unshare_iter is\nvery very broken, which bfoster's recent fsx changes have exposed.\n\nIf the pos and len passed to dax_file_unshare are not aligned to an\nfsblock boundary, the iter pos and length in the _iter function will\nreflect this unalignment.\n\ndax_iomap_direct_access always returns a pointer to the start of the\nkmapped fsdax page, even if its pos argument is in the middle of that\npage. This is catastrophic for data integrity when iter->pos is not\naligned to a page, because daddr/saddr do not point to the same byte in\nthe file as iter->pos. Hence we corrupt user data by copying it to the\nwrong place.\n\nIf iter->pos + iomap_length() in the _iter function not aligned to a\npage, then we fail to copy a full block, and only partially populate the\ndestination block. This is catastrophic for data confidentiality\nbecause we expose stale pmem contents.\n\nFix both of these issues by aligning copy_pos/copy_len to a page\nboundary (remember, this is fsdax so 1 fsblock == 1 base page) so that\nwe always copy full blocks.\n\nWe're not done yet -- there's no call to invalidate_inode_pages2_range,\nso programs that have the file range mmap'd will continue accessing the\nold memory mapping after the file metadata updates have completed.\n\nBe careful with the return value -- if the unshare succeeds, we still\nneed to return the number of bytes that the iomap iter thinks we're\noperating on."
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"metrics": {},
|
||
|
|
"references": [
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/50793801fc7f6d08def48754fb0f0706b0cfc394",
|
||
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/8e9c0f500b42216ef930f5c0d1703989a451913d",
|
||
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/9bc18bb476e50e32e5d08f2734d63d63e0fa528c",
|
||
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"url": "https://git.kernel.org/stable/c/bdbc96c23197d773a7d1bf03e4f11de593b0ff28",
|
||
|
|
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|