[Bug 258914] g_label_ntfs_taste() doesn't validate data read from disk, can generate wild pointers

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258914

            Bug ID: 258914
           Summary: g_label_ntfs_taste() doesn't validate data read from
                    disk, can generate wild pointers
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: rtm@lcs.mit.edu

Created attachment 228428
  --> https://bugs.freebsd.org/bugzilla/attachment.cgi?id=228428&action=edit
Disk or USB memory stick image that causes an infinite loop in the kernel.

g_label_ntfs_taste() in sys/geom/label/g_label_ntfs.c reads
from newly inserted disks (e.g. USB memory sticks that may
be corrupt or malicious) and uses the data without validation
to form pointers, which it dereferences.

    filerecp = g_read_data(cp, voloff, recsize, NULL);
    fr = (struct ntfs_filerec *)filerecp;
    for (ap = filerecp + fr->fr_attroff;
        atr = (struct ntfs_attr *)ap, atr->a_type != -1;
        ap += atr->reclen) {

Whoever created the disk image controls atr->reclen, and
thus can control the value of pointer atr. I've attached a
disk image whose atr->reclen is zero, and which will generate
an infinite loop in the kernel. Other values of atr->reclen
cause kernel page faults.

-- 
You are receiving this mail because:
You are the assignee for the bug.