Linux OCFS2 Out-of-Range Read: KASAN Slab-UAF in ocfs2_get_system_file_inode

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: ocfs2: validate DIO orphan node during inode read Vulnerability Type: Out-of-range read Root Cause: uses as an index into the slot table (slot-local system inode cache) without validating whether the value is within bounds. When is an out-of-bounds value, it generates an invalid cache entry pointer, leading to the dereference of an invalid pointer (use-after-free error). Trigger Scenario: A corrupted QDIO orphan node (high byte at offset 0x40) changing from 0 to 1 can cause an out-of-bounds access to the slot table of the mounted filesystem when handling a DIO orphan node. Impact Scope Affected Module: Linux kernel filesystem Affected Functions: - (fs/ocfs2/super.c:102) - (fs/ocfs2/super.c:1295) - (fs/ocfs2/super.c:1355) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (fs/ocfs2/super.c:1395) - (

Goal Reached Thanks to every supporter — we hit 100%!

Linux OCFS2 Out-of-Range Read: KASAN Slab-UAF in ocfs2_get_system_file_inode

More from this source