mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 15:47:23 +00:00
Code Issues Projects Releases Wiki Activity

ntfs-3g-ntfsprogs: fix CVE-2026-46569

Browse Source 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/961ed5c2fa2f36ef6a347f04e1fa586113c97e7c
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46569

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya authored and Anuj Mittal committed 2026-10-29 10:19:03 +05:30
1 parent cc1cc98d51
commit 40eac38e56
2 files changed
+63
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46569.patch
+62
View File
@@ -0,0 +1,62 @@
From 677d21be1ac7ec0a59cfbed8e26d1ffbf0922ac1 Mon Sep 17 00:00:00 2001
From: Rakesh Pandit <rakesh@tuxera.com>
Date: Mon, 8 Jun 2026 10:34:38 +0300
Subject: [PATCH] Bound tail_size in ntfs_ib_copy_tail against destination
capacity.
A crafted source INDX block can drive tail_size past the freshly
allocated destination's usable space and overflow the memcpy. Add
a capacity check (and a < 0 guard against sign-extension at
memcpy).
Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting
this issue.
CVE: CVE-2026-46569
Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/961ed5c2fa2f36ef6a347f04e1fa586113c97e7c]
(cherry picked from commit 961ed5c2fa2f36ef6a347f04e1fa586113c97e7c)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
libntfs-3g/index.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/libntfs-3g/index.c b/libntfs-3g/index.c
index 9c11a45c..347bd408 100644
--- a/libntfs-3g/index.c
+++ b/libntfs-3g/index.c
@@ -1193,7 +1193,7 @@ static int ntfs_ib_copy_tail(ntfs_index_context *icx, INDEX_BLOCK *src,
{
u8 *ies_end;
INDEX_ENTRY *ie_head; /* first entry after the median */
- int tail_size, ret;
+ int tail_size, dst_capacity, ret;
INDEX_BLOCK *dst;
ntfs_log_trace("Entering\n");
@@ -1207,6 +1207,25 @@ static int ntfs_ib_copy_tail(ntfs_index_context *icx, INDEX_BLOCK *src,
ies_end = (u8 *)ntfs_ie_get_end(&src->index);
tail_size = ies_end - (u8 *)ie_head;
+ dst_capacity = (int)(le32_to_cpu(dst->index.allocated_size)
+ - le32_to_cpu(dst->index.entries_offset));
+
+ /*
+ * src->index.entries_offset (on-disk, only required to be >=
+ * sizeof(INDEX_HEADER) by ntfs_index_block_inconsistent) may be smaller
+ * than dst's, which ntfs_ib_alloc fixes (40 on a 4 KiB block). When
+ * the median lands near the start of the source stream the gap lets
+ * tail_size exceed dst's usable space. The < 0 guard catches a
+ * negative tail_size before memcpy sign-extends it into a huge size_t.
+ */
+ if (tail_size < 0 || tail_size > dst_capacity) {
+ ntfs_log_error("Invalid tail_size %d (dst capacity %d) in "
+ "ntfs_ib_copy_tail\n", tail_size, dst_capacity);
+ free(dst);
+ errno = EIO;
+ return STATUS_ERROR;
+ }
+
memcpy(ntfs_ie_get_first(&dst->index), ie_head, tail_size);
dst->index.index_length = cpu_to_le32(tail_size +
meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
+1
View File
@@ -14,6 +14,7 @@ SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV}
file://CVE-2026-46572_CVE-2026-42617_p3.patch \
file://CVE-2026-46571.patch \
file://CVE-2026-46570.patch \
file://CVE-2026-46569.patch \
"
SRCREV = "78414d93613532fd82f3a82aba5d4a1c32898781"