In the Linux kernel, the following vulnerability has been resolved: ftruncate: pass a signed offset The old ftruncate() syscall, using the 32-bit off_t misses a sign extension when called in compat mode on 64-bit architectures. As a result, passing a negative length accidentally succeeds in truncating to file size between 2GiB and 4GiB. Changing the type of the compat syscall to the signed compat_off_t changes the behavior so it instead returns -EINVAL. The native entry point, the truncate() syscall and the corresponding loff_t based variants are all correct already and do not suffer from this mistake.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 12 | all | linux | < 6.1.98-1 | linux_6.1.98-1_all.deb |
Debian | 11 | all | linux | < 5.10.221-1 | linux_5.10.221-1_all.deb |
Debian | 999 | all | linux | < 6.9.8-1 | linux_6.9.8-1_all.deb |
Debian | 13 | all | linux | < 6.9.8-1 | linux_6.9.8-1_all.deb |