ntfs: Fix min_len for compressed/sparse attributes in ntfs_non_resident_attr_value_is_valid()

Here the attribute validator computes a single min_len = 64 (as the end of
initialized_size) for all non-resident attributes regardless of the flags
field. This is correct for regular non-resident attributes but for sparse
or compressed non-resident attributes the fixed header is 8 bytes longer,
it includes a compressed_size field at bytes 64-71, min_len should be 72.

Since the validator lets a sparse/compressed attr_record be less than the
correct length, caller's accesses to compressed_size
(e.g., ntfs_read_locked_inode() or ntfs_attr_update_mapping_pairs()) can
extend past the attribute declared boundary.
This can cause OOB reads or OOB writes past the MFT record buffer if the
attribute is positioned near the end of the MFT record.

The compressed_size field is accessed from:
- ntfs_read_locked_inode()
- ntfs_read_locked_attr_inode()
- ntfs_attr_open()
- ntfs_attr_update_mapping_pairs()

ntfs_attr_make_non_resident() seems to be safe.

Fixing this by raising min_len for sparse/compressed attributes in the
validator.

The OOB reads and the OOB writes require a crafted filesystem image, which
is not in the kernel threat model, anyway, fixing memory errors would be
nice to keep things secure.

Signed-off-by: Alexandro Calo <alexandro.calo@nozominetworks.com>
Reviewed-by: Hyunchul Lee <hyc.lee@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>

0 files changed, 0 insertions, 0 deletions