mslacken/e2fsprogs
1
0
Fork 0
forked from pool/e2fsprogs
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Set link to e2fsprogs.23992 via maintenance_release request

Browse Source 
Rev SUSE:SLE-15:Update/10 Md5 fdf4a7fcf741a72975a161b95e90be83 2022-05-16 12:02:46 abergmann None
This commit is contained in:
OBS User abergmann 2022-05-16 12:02:46 +00:00 committed by Git OBS Bridge
parent d9e48194c2
commit c978493e09
3 changed files with 64 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
e2fsprogs.changes
View File

@ -1,3 +1,9 @@
-------------------------------------------------------------------
Fri Apr 29 16:00:00 UTC 2022 - Jan Kara <jack@suse.cz>
- libext2fs-add-sanity-check-to-extent-manipulation.patch: libext2fs: add
sanity check to extent manipulation (bsc#1198446 CVE-2022-1304)
-------------------------------------------------------------------
Thu Mar 17 08:35:39 UTC 2022 - Jan Kara <jack@suse.cz>

2
e2fsprogs.spec
View File

@ -95,6 +95,7 @@ Patch16: tests-add-test-to-excercise-indexed-directories-with.patch
Patch17: tune2fs-update-dir-checksums-when-clearing-dir_index.patch
Patch18: po-remove-unnecessary-buggy-positional-parameter-spe.patch
Patch19: libss-add-newer-libreadline.so.7-to-dlopen-path.patch
Patch20: libext2fs-add-sanity-check-to-extent-manipulation.patch
# Do not suppress make commands
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@ -253,6 +254,7 @@ Development files for the com_err error message display library. Static librarie
%patch17 -p1
%patch18 -p1
%patch19 -p1
%patch20 -p1
cp %{SOURCE2} .
%build

56
libext2fs-add-sanity-check-to-extent-manipulation.patch Normal file
View File

@ -0,0 +1,56 @@
From ab51d587bb9b229b1fade1afd02e1574c1ba5c76 Mon Sep 17 00:00:00 2001
From: Lukas Czerner <lczerner@redhat.com>
Date: Thu, 21 Apr 2022 19:31:48 +0200
Subject: [PATCH] libext2fs: add sanity check to extent manipulation
References: bsc#1198446 CVE-2022-1304
It is possible to have a corrupted extent tree in such a way that a leaf
node contains zero extents in it. Currently if that happens and we try
to traverse the tree we can end up accessing wrong data, or possibly
even uninitialized memory. Make sure we don't do that.
Additionally make sure that we have a sane number of bytes passed to
memmove() in ext2fs_extent_delete().
Note that e2fsck is currently unable to spot and fix such corruption in
pass1.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reported-by: Nils Bars <nils_bars@t-online.de>
Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=2068113
Addresses: CVE-2022-1304
Addresses-Debian-Bug: #1010263
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
---
lib/ext2fs/extent.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/lib/ext2fs/extent.c b/lib/ext2fs/extent.c
index b324c7b0f8c8..1a206a16c13f 100644
--- a/lib/ext2fs/extent.c
+++ b/lib/ext2fs/extent.c
@@ -495,6 +495,10 @@ retry:
ext2fs_le16_to_cpu(eh->eh_entries);
newpath->max_entries = ext2fs_le16_to_cpu(eh->eh_max);
+ /* Make sure there is at least one extent present */
+ if (newpath->left <= 0)
+ return EXT2_ET_EXTENT_NO_DOWN;
+
if (path->left > 0) {
ix++;
newpath->end_blk = ext2fs_le32_to_cpu(ix->ei_block);
@@ -1630,6 +1634,10 @@ errcode_t ext2fs_extent_delete(ext2_extent_handle_t handle, int flags)
cp = path->curr;
+ /* Sanity check before memmove() */
+ if (path->left < 0)
+ return EXT2_ET_EXTENT_LEAF_BAD;
+
if (path->left) {
memmove(cp, cp + sizeof(struct ext3_extent_idx),
path->left * sizeof(struct ext3_extent_idx));
--
2.34.1