In the Linux kernel, the following vulnerability has been resolved:

fs/ntfs3: add bounds check to run_get_highest_vcn()

run_get_highest_vcn() parses a packed NTFS mapping-pairs buffer without
any length bound, relying solely on a 0x00 terminator to stop.  A
crafted $LogFile UpdateMappingPairs record whose embedded attribute
contains mapping-pairs runs without a terminator causes the function to
read past the slab allocation, triggering a KASAN slab-out-of-bounds
read on mount.

The sibling function run_unpack() received an analogous bounds-check in
commit b62567bca474 ("ntfs3: add buffer boundary checks to run_unpack()"),
but run_get_highest_vcn() was missed.

Take a run_buf_size parameter and reject any run header whose payload
would extend past the buffer end, mirroring the pattern used by
run_unpack().  The caller in fslog.c passes the remaining attribute
bytes after the mapping-pairs offset.

KASAN report (on mainline v7.1 merge window HEAD):

  BUG: KASAN: slab-out-of-bounds in run_get_highest_vcn+0x3c0/0x410
  Read of size 1 at addr ffff88800e2d5400 by task mount/72
  Call Trace:
   run_get_highest_vcn+0x3c0/0x410
   do_action.isra.0+0x3ba8/0x7b50
   log_replay+0x9ddd/0x10200
   ntfs_loadlog_and_replay+0x4ad/0x610
   ntfs_fill_super+0x214a/0x4540

https://git.kernel.org/stable/c/41081202eb823f5b27ff164b12010b24428100ad

https://git.kernel.org/stable/c/8afc24a884aff6a6f08028bd779ee65c40054455

https://git.kernel.org/stable/c/a31893206588374d7d16fad387189d8165c7efd3

https://git.kernel.org/stable/c/bb11485a87fbb2254b62cfed630b699d50e57da8

https://git.kernel.org/stable/c/c23083b472a720c3f60b147db05b25b751c7c1bf

https://git.kernel.org/stable/c/c69b9003332917b652175d5fa9d84158c5ed8617

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ntfs3/fslog.c","fs/ntfs3/ntfs_fs.h","fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"425de2aba0d061b3e715d51a3b1992c112ed5b99","lessThan":"c69b9003332917b652175d5fa9d84158c5ed8617","versionType":"git","status":"affected"},{"version":"bf7ac4a1d3bfc6e56e54635c3d331a68170d37c9","lessThan":"8afc24a884aff6a6f08028bd779ee65c40054455","versionType":"git","status":"affected"},{"version":"e64f7dfcaff79e7dfff9121a382dd77f9b462f62","lessThan":"c23083b472a720c3f60b147db05b25b751c7c1bf","versionType":"git","status":"affected"},{"version":"d3012690a7065d9ca86521a525ad11e8af491d45","lessThan":"a31893206588374d7d16fad387189d8165c7efd3","versionType":"git","status":"affected"},{"version":"b62567bca47408e6739dee75f02a2113548af875","lessThan":"41081202eb823f5b27ff164b12010b24428100ad","versionType":"git","status":"affected"},{"version":"b62567bca47408e6739dee75f02a2113548af875","lessThan":"bb11485a87fbb2254b62cfed630b699d50e57da8","versionType":"git","status":"affected"},{"version":"bbad75336870b51b81979b97613746237fcb02fe","versionType":"git","status":"affected"},{"version":"41aadf5cb482793a24e05aa136224e179a778586","versionType":"git","status":"affected"},{"version":"6.1.175","lessThan":"6.1.178","versionType":"semver","status":"affected"},{"version":"6.6.140","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.86","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.18.27","lessThan":"6.18.40","versionType":"semver","status":"affected"},{"version":"5.15.209","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"7.0.4","lessThan":"7.1","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ntfs3/fslog.c","fs/ntfs3/ntfs_fs.h","fs/ntfs3/run.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.1","status":"affected"},{"version":"0","lessThan":"7.1","versionType":"semver","status":"unaffected"},{"version":"6.1.178","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]