mirrors/meta-openembedded
1
0 Fork 0
mirror of https://github.com/openembedded/meta-openembedded.git synced 2026-11-13 03:37:15 +00:00
Code Issues Projects Releases Wiki Activity

ntfs-3g-ntfsprogs: fix CVE-2026-46570

Browse Source 
This patch applies the upstream fix shown in [1]. The NVD record
describing the vulnerability is referenced in [2].

[1] https://github.com/tuxera/ntfs-3g/commit/5ab37421ebbcbf33bf96876c7a034393bda05a25
[2] https://nvd.nist.gov/vuln/detail/CVE-2026-46570

Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
Signed-off-by: Anuj Mittal <anuj.mittal@oss.qualcomm.com>
This commit is contained in:
Darsh Kelaiya authored and Anuj Mittal committed 2026-10-29 10:19:02 +05:30
1 parent bd5043efd3
commit cc1cc98d51
2 files changed
+43
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/files/CVE-2026-46570.patch
+42
View File
@@ -0,0 +1,42 @@
From bb4da656cab16325002eaf785ca967d426510e94 Mon Sep 17 00:00:00 2001
From: Rakesh Pandit <rakesh@tuxera.com>
Date: Mon, 8 Jun 2026 14:24:54 +0300
Subject: [PATCH] Cap B tree depth in ntfs_index_walk_down to MAX_PARENT_VCN.
ntfs_index_walk_down() incremented ictx->pindex and wrote into
ictx->parent_pos[] / parent_vcn[] (both sized MAX_PARENT_VCN) without
checking the bound. A B+tree deeper than MAX_PARENT_VCN levels then
overflowed both arrays and since parent_vcn[32] overlaps the pindex
field the OOB write gave an attacker control over the next iteration's
offset and value.
Thanks to Alexandro Calo' from Nozomi Networks Labs for reporting this
issue.
CVE: CVE-2026-46570
Upstream-Status: Backport [https://github.com/tuxera/ntfs-3g/commit/5ab37421ebbcbf33bf96876c7a034393bda05a25]
(cherry picked from commit 5ab37421ebbcbf33bf96876c7a034393bda05a25)
Signed-off-by: Darsh Kelaiya <dkelaiya@cisco.com>
---
libntfs-3g/index.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libntfs-3g/index.c b/libntfs-3g/index.c
index c9651a62..9c11a45c 100644
--- a/libntfs-3g/index.c
+++ b/libntfs-3g/index.c
@@ -2105,6 +2105,13 @@ static INDEX_ENTRY *ntfs_index_walk_down(INDEX_ENTRY *ie,
/* down from non-zero level */
ictx->pindex++;
+ if (ictx->pindex >= MAX_PARENT_VCN) {
+ errno = EOPNOTSUPP;
+ ntfs_log_perror("Index is over %d level deep",
+ MAX_PARENT_VCN);
+ entry = (INDEX_ENTRY*)NULL;
+ break;
+ }
}
ictx->parent_pos[ictx->pindex] = 0;
ictx->parent_vcn[ictx->pindex] = vcn;
meta-filesystems/recipes-filesystems/ntfs-3g-ntfsprogs/ntfs-3g-ntfsprogs_2022.10.3.bb
+1
View File
@@ -13,6 +13,7 @@ SRC_URI = "git://github.com/tuxera/ntfs-3g;protocol=https;branch=edge;tag=${PV}
file://CVE-2026-46572_CVE-2026-42617_p2.patch \
file://CVE-2026-46572_CVE-2026-42617_p3.patch \
file://CVE-2026-46571.patch \
file://CVE-2026-46570.patch \
"
SRCREV = "78414d93613532fd82f3a82aba5d4a1c32898781"