mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 03:37:15 +00:00
Code Issues Projects Releases Wiki Activity

ntfs-3g-ntfsprogs: fix CVE-2026-46571

Browse Source 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/b912272b30c552b0457e40a0a68b1fac2587aaea
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46571

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya authored and Anuj Mittal committed 2026-10-26 10:10:49 +05:30
1 parent d9a9a74915
commit 861b62a7cc
2 files changed
+51
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46571.patch
+50
View File
@@ -0,0 +1,50 @@
From fc32321c8c795e9f73cbdd8f36fcd9e0a3a9814b Mon Sep 17 00:00:00 2001
From: Rakesh Pandit <rakesh@tuxera.com>
Date: Mon, 8 Jun 2026 14:16:39 +0300
Subject: [PATCH] reparse.c: Bounds-check locase index in ntfs_fix_file_name.
The case-insensitive branch indexed vol->locase with a raw 16-bit code
point and no check against vol->upcase_len. A truncated $UpCase made
the table shorter than 65536 entries, so a file name character >=
upcase_len read past it and leaked 2 heap bytes via the symlink target
returned to userspace.
Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
issue.
CVE: CVE-2026-46571
Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/b912272b30c552b0457e40a0a68b1fac2587aaea]
(cherry picked from commit b912272b30c552b0457e40a0a68b1fac2587aaea)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
libntfs-3g/reparse.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/libntfs-3g/reparse.c b/libntfs-3g/reparse.c
index 76dbe2f1..54858caa 100644
--- a/libntfs-3g/reparse.c
+++ b/libntfs-3g/reparse.c
@@ -196,11 +196,19 @@ static u64 ntfs_fix_file_name(ntfs_inode *dir_ni, ntfschar *uname,
lemref = entry->indexed_file;
mref = le64_to_cpu(lemref);
if (NVolCaseSensitive(vol) || !vol->locase) {
- for (i=0; i<found->file_name_length; i++)
+ for (i=0; i<found->file_name_length;
+ i++)
uname[i] = found->file_name[i];
} else {
- for (i=0; i<found->file_name_length; i++)
- uname[i] = vol->locase[le16_to_cpu(found->file_name[i])];
+ for (i=0; i<found->file_name_length;
+ i++) {
+ u16 u = le16_to_cpu(found->
+ file_name[i]);
+ uname[i] = (u < vol->upcase_len)
+ ? vol->locase[u]
+ : found->
+ file_name[i];
+ }
}
}
}
meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
+1
View File
@@ -11,6 +11,7 @@ SRC_URI = "http://tuxera.com/opensource/ntfs-3g_ntfsprogs-${PV}.tgz \
file://CVE-2026-46572_CVE-2026-42617_p1.patch \
file://CVE-2026-46572_CVE-2026-42617_p2.patch \
file://CVE-2026-46572_CVE-2026-42617_p3.patch \
file://CVE-2026-46571.patch \
"
S = "${WORKDIR}/ntfs-3g_ntfsprogs-${PV}"
SRC_URI[sha256sum] = "f20e36ee68074b845e3629e6bced4706ad053804cbaf062fbae60738f854170c"