In the Linux kernel, the following vulnerability has been resolved:
ocfs2: strict bound check before memcmp in ocfs2xattrfind_entry()
xattr in ocfs2 maybe 'non-indexed', which saved with additional space requested. It's better to check if the memory is out of bound before memcmp, although this possibility mainly comes from crafted poisonous images.
[
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfb926051fab19b10d1e65976211f364aa820180",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-122cc5a2",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4ffea01adf3323c821b6f37e9577d2d400adbaa",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-342c9739",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57a3d89831fcaa2cdbe024b47c7c36d5a56c3637",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-44c942d9",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c726dea9d0c806d64c26fcef483b1fb9474d8c5e",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-55972b4f",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e4ffea01adf3323c821b6f37e9577d2d400adbaa",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-64949c50",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8f9c4af7af7e9e4cd09c0251c7936593147419f",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-68a7eb86",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-a56e7d24",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c031d286eceb82f72f8623b7f4abd2aa491bfb5e",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-a86e833a",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@cfb926051fab19b10d1e65976211f364aa820180",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-b8158451",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-bb64e3d1",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c031d286eceb82f72f8623b7f4abd2aa491bfb5e",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-c287421d",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@57a3d89831fcaa2cdbe024b47c7c36d5a56c3637",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-d0845608",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e8f9c4af7af7e9e4cd09c0251c7936593147419f",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-d130fd94",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af77c4fc1871847b528d58b7fdafb4aa1f6a9262",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-da22f347",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Function",
"target": {
"function": "ocfs2_xattr_find_entry",
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@af77c4fc1871847b528d58b7fdafb4aa1f6a9262",
"digest": {
"length": 701.0,
"function_hash": "249970194345566055521514047187728041672"
},
"id": "CVE-2024-41016-f2e1864a",
"signature_version": "v1",
"deprecated": false
},
{
"signature_type": "Line",
"target": {
"file": "fs/ocfs2/xattr.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c726dea9d0c806d64c26fcef483b1fb9474d8c5e",
"digest": {
"line_hashes": [
"148873507870419452345161580904482301695",
"314702584731371547657591463947440322349",
"160592385288297043045248270863670720224",
"11617910698105711624679070622067435563",
"286208606924909576097817293697080479009",
"185157151049642631351387107655644640066",
"331191749335071362528500111670682402001",
"115117240763369144458939622096439320502",
"18688286141153098072958222726263247918",
"34158956313432580713439738761136992565",
"148545395263346898713453326350742146679"
],
"threshold": 0.9
},
"id": "CVE-2024-41016-f53f8e0b",
"signature_version": "v1",
"deprecated": false
}
]