Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-46989
HistoryFeb 28, 2024 - 12:00 a.m.

CVE-2021-46989

2024-02-2800:00:00
ubuntu.com
ubuntu.com
6
linux kernel
hfs+ filesystem
vulnerability
corruption
shrinking truncate

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%

In the Linux kernel, the following vulnerability has been resolved:
hfsplus: prevent corruption in shrinking truncate I believe there are some
issues introduced by commit 31651c607151 (“hfsplus: avoid deadlock on file
truncation”) HFS+ has extent records which always contains 8 extents. In
case the first extent record in catalog file gets full, new ones are
allocated from extents overflow file. In case shrinking truncate happens to
middle of an extent record which locates in extents overflow file, the
logic in hfsplus_file_truncate() was changed so that call to
hfs_brec_remove() is not guarded any more. Right action would be just
freeing the extents that exceed the new size inside extent record by
calling hfsplus_free_extents(), and then check if the whole extent record
should be removed. However since the guard (blk_cnt > start) is now after
the call to hfs_brec_remove(), this has unfortunate effect that the last
matching extent record is removed unconditionally. To reproduce this issue,
create a file which has at least 10 extents, and then perform shrinking
truncate into middle of the last extent record, so that the number of
remaining extents is not under or divisible by 8. This causes the last
extent record (8 extents) to be removed totally instead of truncating into
middle of it. Thus this causes corruption, and lost data. Fix for this is
simply checking if the new truncated end is below the start of this extent
record, making it safe to remove the full extent record. However call to
hfs_brec_remove() can’t be moved to it’s previous place since we’re
dropping ->tree_lock and it can cause a race condition and the cached info
being invalidated possibly corrupting the node data. Another issue is
related to this one. When entering into the block (blk_cnt > start) we are
not holding the ->tree_lock. We break out from the loop not holding the
lock, but hfs_find_exit() does unlock it. Not sure if it’s possible for
someone else to take the lock under our feet, but it can cause hard to
debug errors and premature unlocking. Even if there’s no real risk of it,
the locking should still always be kept in balance. Thus taking the lock
now just before the check.

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.4%