Описание
In the Linux kernel, the following vulnerability has been resolved:
fuse: invalidate the correct range after O_APPEND direct write
fuse_direct_write_iter() captures pos before generic_write_checks(), which moves ki_pos to EOF for O_APPEND writes:
fuse_direct_write_iter() { pos = iocb->ki_pos; /* 0 (user-supplied) / generic_write_checks(); / ki_pos -> EOF / fuse_direct_io(); / writes at EOF, correct / invalidate(pos, pos + res); / [0, res) -- wrong */ }
The post-write invalidation targets a stale range instead of the actual written range at EOF.
This can cause data inconsistency when the file size is not page-aligned. The tail page straddling EOF has a valid portion before EOF that concurrent readers can fault back in during the DIO write window:
Tail page (file size X not page-aligned):
CPU0 (O_APPEND DIO w
EPSS
Дефекты
Связанные уязвимости
(In the Linux kernel, the following vulnerability has been resolved: f ...)
In the Linux kernel, the following vulnerability has been resolved: f ...
In the Linux kernel, the following vulnerability has been resolved: fuse: invalidate the correct range after O_APPEND direct write fuse_direct_write_iter() captures pos before generic_write_checks(), which moves ki_pos to EOF for O_APPEND writes: fuse_direct_write_iter() { pos = iocb->ki_pos; /* 0 (user-supplied) */ generic_write_checks(); /* ki_pos -> EOF */ fuse_direct_io(); /* writes at EOF, correct */ invalidate(pos, pos + res); /* [0, res) -- wrong */ } The post-write invalidation targets a stale range instead of the actual written range at EOF. This can cause data inconsistency when the file size is not page-aligned. The tail page straddling EOF has a valid portion before EOF that concurrent readers can fault back in during the DIO write window: Tail page (file size X not page-aligned): page_start X (EOF) page_end |--- valid data ----|-- stale --| CPU0 (O_APPEND DI...
EPSS