In the Linux kernel, the following vulnerability has been resolved:
btrfs: dev-replace: properly validate device names
There's a syzbot report that device name buffers passed to device replace are not properly checked for string termination which could lead to a read out of bounds in getname_kernel().
Add a helper that validates both source and target device name buffers. For devid as the source initialize the buffer to empty string in case something tries to read it later.
This was originally analyzed and fixed in a different way by Edward Adam Davis (see links).
[
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1690ced4d2d8b28868811fb81cd33eee5aefee1",
"signature_version": "v1",
"id": "CVE-2024-26791-0193465f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9845664b9ee47ce7ee7ea93caf47d39a9d4552c4",
"signature_version": "v1",
"id": "CVE-2024-26791-0bf017d0",
"digest": {
"function_hash": "277627457608968661633159801541260590056",
"length": 775.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343eecb4ff49a7b1cc1dfe86958a805cf2341cfb",
"signature_version": "v1",
"id": "CVE-2024-26791-1b9e29ec",
"digest": {
"function_hash": "277627457608968661633159801541260590056",
"length": 775.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b1690ced4d2d8b28868811fb81cd33eee5aefee1",
"signature_version": "v1",
"id": "CVE-2024-26791-220cb587",
"digest": {
"function_hash": "277627457608968661633159801541260590056",
"length": 775.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2d68655d0f04650bef09fee948ff80597c5fb9",
"signature_version": "v1",
"id": "CVE-2024-26791-2bfd7b78",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6652e20d7d783d060fe5f987eac7b5cabe31311",
"signature_version": "v1",
"id": "CVE-2024-26791-99fbaa00",
"digest": {
"function_hash": "277627457608968661633159801541260590056",
"length": 775.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2886fe308a83968dde252302884a1e63351cf16d",
"signature_version": "v1",
"id": "CVE-2024-26791-b45896a9",
"digest": {
"function_hash": "277627457608968661633159801541260590056",
"length": 775.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9845664b9ee47ce7ee7ea93caf47d39a9d4552c4",
"signature_version": "v1",
"id": "CVE-2024-26791-b67b4304",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ab2d68655d0f04650bef09fee948ff80597c5fb9",
"signature_version": "v1",
"id": "CVE-2024-26791-b8d2e8d9",
"digest": {
"function_hash": "277627457608968661633159801541260590056",
"length": 775.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f590040ce2b712177306b03c2a63b16f7d48d3c8",
"signature_version": "v1",
"id": "CVE-2024-26791-b8f444d0",
"digest": {
"function_hash": "277627457608968661633159801541260590056",
"length": 775.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11d7a2e429c02d51e2dc90713823ea8b8d3d3a84",
"signature_version": "v1",
"id": "CVE-2024-26791-c634ef80",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c6652e20d7d783d060fe5f987eac7b5cabe31311",
"signature_version": "v1",
"id": "CVE-2024-26791-cb46b14f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Function",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@11d7a2e429c02d51e2dc90713823ea8b8d3d3a84",
"signature_version": "v1",
"id": "CVE-2024-26791-e0e46309",
"digest": {
"function_hash": "183144046440632072961022336827846634835",
"length": 724.0
},
"target": {
"function": "btrfs_dev_replace_by_ioctl",
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2886fe308a83968dde252302884a1e63351cf16d",
"signature_version": "v1",
"id": "CVE-2024-26791-e2fa47dd",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f590040ce2b712177306b03c2a63b16f7d48d3c8",
"signature_version": "v1",
"id": "CVE-2024-26791-eff398eb",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
},
{
"signature_type": "Line",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@343eecb4ff49a7b1cc1dfe86958a805cf2341cfb",
"signature_version": "v1",
"id": "CVE-2024-26791-f72b0f73",
"digest": {
"threshold": 0.9,
"line_hashes": [
"168235006542778250515998068159994199894",
"12486598897418282752709675932141890700",
"189894559253887376211397332142964389071",
"232052283400833139617447684872152727927",
"92828131399642899241277395885137885107",
"267461384638968942186659398564984561903",
"124153574645244937321667124659867352281",
"200541393908128639741824535726819343661",
"50066342271234927054964092970942375508"
]
},
"target": {
"file": "fs/btrfs/dev-replace.c"
}
}
]