mirror of
https://github.com/torvalds/linux.git
synced 2026-07-28 01:55:51 +02:00
2dc0bfd2fe
aix_partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:
int numpps = be16_to_cpu(pvd->pp_count);
...
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
...
lp_ix = be16_to_cpu(p->lp_ix);
pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp_count. pp_count is an unvalidated __be16 read straight from
the descriptor, so a crafted AIX image with pp_count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos_partition() -> aix_partition().
Clamp the scan to the number of entries the ppe[] array can hold.
Fixes:
|
||
|---|---|---|
| .. | ||
| acorn.c | ||
| aix.c | ||
| amiga.c | ||
| atari.c | ||
| atari.h | ||
| check.h | ||
| cmdline.c | ||
| core.c | ||
| efi.c | ||
| efi.h | ||
| ibm.c | ||
| karma.c | ||
| Kconfig | ||
| ldm.c | ||
| ldm.h | ||
| mac.c | ||
| mac.h | ||
| Makefile | ||
| msdos.c | ||
| of.c | ||
| osf.c | ||
| sgi.c | ||
| sun.c | ||
| sysv68.c | ||
| ultrix.c | ||