Description

In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs/namei.c:1649 walk_component fs/namei.c:2001 [inline] link_path_walk+0x817/0x1480 fs/namei.c:2332 path_lookupat+0xd9/0x6f0 fs/namei.c:2485 filename_lookup+0x22e/0x740 fs/namei.c:2515 user_path_at_empty+0x8b/0x390 fs/namei.c:2924 user_path_at include/linux/namei.h:57 [inline] do_mount fs/namespace.c:3689 [inline] __do_sys_mount fs/namespace.c:3898 [inline] __se_sys_mount+0x66b/0x810 fs/namespace.c:3875 __x64_sys_mount+0xe4/0x140 fs/namespace.c:3875 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b BUG: KMSAN: uninit-value in hfs_ext_read_extent fs/hfs/extent.c:196 [inline] BUG: KMSAN: uninit-value in hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 hfs_ext_read_extent fs/hfs/extent.c:196 [inline] hfs_get_block+0x92d/0x1620 fs/hfs/extent.c:366 block_read_full_folio+0x4ff/0x11b0 fs/buffer.c:2271 hfs_read_folio+0x55/0x60 fs/hfs/inode.c:39 filemap_read_folio+0x148/0x4f0 mm/filemap.c:2426 do_read_cache_folio+0x7c8/0xd90 mm/filemap.c:3553 do_read_cache_page mm/filemap.c:3595 [inline] read_cache_page+0xfb/0x2f0 mm/filemap.c:3604 read_mapping_page include/linux/pagemap.h:755 [inline] hfs_btree_open+0x928/0x1ae0 fs/hfs/btree.c:78 hfs_mdb_get+0x260c/0x3000 fs/hfs/mdb.c:204 hfs_fill_super+0x1fb1/0x2790 fs/hfs/super.c:406 mount_bdev+0x628/0x920 fs/super.c:1359 hfs_mount+0xcd/0xe0 fs/hfs/super.c:456 legacy_get_tree+0x167/0x2e0 fs/fs_context.c:610 vfs_get_tree+0xdc/0x5d0 fs/super.c:1489 do_new_mount+0x7a9/0x16f0 fs/namespace.c:3145 path_mount+0xf98/0x26a0 fs/namespace.c:3475 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x919/0x9e0 fs/namespace.c:3674 __ia32_sys_mount+0x15b/0x1b0 fs/namespace.c:3674 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178 do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203 do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Uninit was created at: __alloc_pages+0x9a6/0xe00 mm/page_alloc.c:4590 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page mm/slub.c:2190 [inline] allocate_slab mm/slub.c:2354 [inline] new_slab+0x2d7/0x1400 mm/slub.c:2407 ___slab_alloc+0x16b5/0x3970 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] kmem_cache_alloc_lru+0x64d/0xb30 mm/slub.c:3879 alloc_inode_sb include/linux/fs.h:3018 [inline] hfs_alloc_inode+0x5a/0xc0 fs/hfs/super.c:165 alloc_inode+0x83/0x440 fs/inode.c:260 new_inode_pseudo fs/inode.c:1005 [inline] new_inode+0x38/0x4f0 fs/inode.c:1031 hfs_new_inode+0x61/0x1010 fs/hfs/inode.c:186 hfs_mkdir+0x54/0x250 fs/hfs/dir.c:228 vfs_mkdir+0x49a/0x700 fs/namei.c:4126 do_mkdirat+0x529/0x810 fs/namei.c:4149 __do_sys_mkdirat fs/namei.c:4164 [inline] __se_sys_mkdirat fs/namei.c:4162 [inline] __x64_sys_mkdirat+0xc8/0x120 fs/namei.c:4162 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcf/0x1e0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b It missed to initialize .tz_secondswest, .cached_start and .cached_blocks fields in struct hfs_inode_info after hfs_alloc_inode(), fix it.

Metrics

 

CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score:  5.5 MEDIUM

Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0 Severity and Vector Strings:

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink	Resource
https://git.kernel.org/stable/c/10f7163bfb5f8b4e0c9c05a939f20b8540e33c65	Patch
https://git.kernel.org/stable/c/26a2ed107929a855155429b11e1293b83e6b2a8b	Patch
https://git.kernel.org/stable/c/4a52861cd76e79f1a593beb23d096523eb9732c2	Patch
https://git.kernel.org/stable/c/58d83fc160505a7009c39dec64effaac5129b971	Patch
https://git.kernel.org/stable/c/9c4e40b9b731220f9464975e49da75496e3865c4	Patch
https://git.kernel.org/stable/c/d3493d6f0dfb1ab5225b62faa77732983f2187a1	Patch
https://git.kernel.org/stable/c/d55aae5c1730d6b70d5d8eaff00113cd34772ea3	Patch
https://git.kernel.org/stable/c/f7316b2b2f11cf0c6de917beee8d3de728be24db	Patch

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-908	Use of Uninitialized Resource	NIST

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

3 change records found show changes

Initial Analysis by NIST 9/03/2024 1:38:24 PM

Action	Type	Old Value	New Value
Added	CPE Configuration		Record truncated, showing 500 of 734 characters. View Entire Change Record OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.19.320 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.282 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.224 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.165 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up
Added	CVSS V3.1		NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Added	CWE		NIST CWE-908
Changed	Reference Type	https://git.kernel.org/stable/c/10f7163bfb5f8b4e0c9c05a939f20b8540e33c65 No Types Assigned	https://git.kernel.org/stable/c/10f7163bfb5f8b4e0c9c05a939f20b8540e33c65 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/26a2ed107929a855155429b11e1293b83e6b2a8b No Types Assigned	https://git.kernel.org/stable/c/26a2ed107929a855155429b11e1293b83e6b2a8b Patch
Changed	Reference Type	https://git.kernel.org/stable/c/4a52861cd76e79f1a593beb23d096523eb9732c2 No Types Assigned	https://git.kernel.org/stable/c/4a52861cd76e79f1a593beb23d096523eb9732c2 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/58d83fc160505a7009c39dec64effaac5129b971 No Types Assigned	https://git.kernel.org/stable/c/58d83fc160505a7009c39dec64effaac5129b971 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/9c4e40b9b731220f9464975e49da75496e3865c4 No Types Assigned	https://git.kernel.org/stable/c/9c4e40b9b731220f9464975e49da75496e3865c4 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/d3493d6f0dfb1ab5225b62faa77732983f2187a1 No Types Assigned	https://git.kernel.org/stable/c/d3493d6f0dfb1ab5225b62faa77732983f2187a1 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/d55aae5c1730d6b70d5d8eaff00113cd34772ea3 No Types Assigned	https://git.kernel.org/stable/c/d55aae5c1730d6b70d5d8eaff00113cd34772ea3 Patch
Changed	Reference Type	https://git.kernel.org/stable/c/f7316b2b2f11cf0c6de917beee8d3de728be24db No Types Assigned	https://git.kernel.org/stable/c/f7316b2b2f11cf0c6de917beee8d3de728be24db Patch

CVE Modified by kernel.org 8/19/2024 1:15:09 AM

Action	Type	Old Value	New Value
Added	Reference		kernel.org https://git.kernel.org/stable/c/10f7163bfb5f8b4e0c9c05a939f20b8540e33c65 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/4a52861cd76e79f1a593beb23d096523eb9732c2 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/d55aae5c1730d6b70d5d8eaff00113cd34772ea3 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/f7316b2b2f11cf0c6de917beee8d3de728be24db [No types assigned]

New CVE Received by NIST 8/17/2024 5:15:11 AM

Action	Type	Old Value	New Value
Added	Description		Record truncated, showing 500 of 3877 characters. View Entire Change Record In the Linux kernel, the following vulnerability has been resolved: hfs: fix to initialize fields of hfs_inode_info after hfs_alloc_inode() Syzbot reports uninitialized value access issue as below: loop0: detected capacity change from 0 to 64 ===================================================== BUG: KMSAN: uninit-value in hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 hfs_revalidate_dentry+0x307/0x3f0 fs/hfs/sysdep.c:30 d_revalidate fs/namei.c:862 [inline] lookup_fast+0x89e/0x8e0 fs
Added	Reference		kernel.org https://git.kernel.org/stable/c/26a2ed107929a855155429b11e1293b83e6b2a8b [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/58d83fc160505a7009c39dec64effaac5129b971 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/9c4e40b9b731220f9464975e49da75496e3865c4 [No types assigned]
Added	Reference		kernel.org https://git.kernel.org/stable/c/d3493d6f0dfb1ab5225b62faa77732983f2187a1 [No types assigned]