In the Linux kernel, the following vulnerability has been resolved:
btrfs: dev-replace: properly validate device names
There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel().
Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later.
This was originally analyzed and fixed in a different way by Edward Adam Davis (see links).
{ "vanir_signatures": [ { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-0193465f", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1690ced4d2d8b28868811fb81cd33eee5aefee1" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-0bf017d0", "deprecated": false, "digest": { "length": 775.0, "function_hash": "277627457608968661633159801541260590056" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9845664b9ee47ce7ee7ea93caf47d39a9d4552c4" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-1b9e29ec", "deprecated": false, "digest": { "length": 775.0, "function_hash": "277627457608968661633159801541260590056" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343eecb4ff49a7b1cc1dfe86958a805cf2341cfb" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-220cb587", "deprecated": false, "digest": { "length": 775.0, "function_hash": "277627457608968661633159801541260590056" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1690ced4d2d8b28868811fb81cd33eee5aefee1" }, { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-2bfd7b78", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2d68655d0f04650bef09fee948ff80597c5fb9" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-99fbaa00", "deprecated": false, "digest": { "length": 775.0, "function_hash": "277627457608968661633159801541260590056" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6652e20d7d783d060fe5f987eac7b5cabe31311" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-b45896a9", "deprecated": false, "digest": { "length": 775.0, "function_hash": "277627457608968661633159801541260590056" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2886fe308a83968dde252302884a1e63351cf16d" }, { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-b67b4304", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9845664b9ee47ce7ee7ea93caf47d39a9d4552c4" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-b8d2e8d9", "deprecated": false, "digest": { "length": 775.0, "function_hash": "277627457608968661633159801541260590056" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2d68655d0f04650bef09fee948ff80597c5fb9" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-b8f444d0", "deprecated": false, "digest": { "length": 775.0, "function_hash": "277627457608968661633159801541260590056" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f590040ce2b712177306b03c2a63b16f7d48d3c8" }, { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-c634ef80", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11d7a2e429c02d51e2dc90713823ea8b8d3d3a84" }, { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-cb46b14f", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6652e20d7d783d060fe5f987eac7b5cabe31311" }, { "target": { "function": "btrfs_dev_replace_by_ioctl", "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-e0e46309", "deprecated": false, "digest": { "length": 724.0, "function_hash": "183144046440632072961022336827846634835" }, "signature_type": "Function", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11d7a2e429c02d51e2dc90713823ea8b8d3d3a84" }, { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-e2fa47dd", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2886fe308a83968dde252302884a1e63351cf16d" }, { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-eff398eb", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f590040ce2b712177306b03c2a63b16f7d48d3c8" }, { "target": { "file": "fs/btrfs/dev-replace.c" }, "id": "CVE-2024-26791-f72b0f73", "deprecated": false, "digest": { "threshold": 0.9, "line_hashes": [ "168235006542778250515998068159994199894", "12486598897418282752709675932141890700", "189894559253887376211397332142964389071", "232052283400833139617447684872152727927", "92828131399642899241277395885137885107", "267461384638968942186659398564984561903", "124153574645244937321667124659867352281", "200541393908128639741824535726819343661", "50066342271234927054964092970942375508" ] }, "signature_type": "Line", "signature_version": "v1", "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343eecb4ff49a7b1cc1dfe86958a805cf2341cfb" } ] }