Updated:
Description:
In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() The hfsplus_bnode_read() method can trigger the issue: [ 174.852007][ T9784] ================================================================== [ 174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360 [ 174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784 [ 174.854059][ T9784] [ 174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full) [ 174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 174.854286][ T9784] Call Trace: [ 174.854289][ T9784] <TASK> [ 174.854292][ T9784] dump_stack_lvl+0x10e/0x1f0 [ 174.854305][ T9784] print_report+0xd0/0x660 [ 174.854315][ T9784] ? __virt_addr_valid+0x81/0x610 [ 174.854323][ T9784] ? __phys_addr+0xe8/0x180 [ 174.854330][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854337][ T9784] kasan_report+0xc6/0x100 [ 174.854346][ T9784] ? hfsplus_bnode_read+0x2f4/0x360 [ 174.854354][ T9784] hfsplus_bnode_read+0x2f4/0x360 [ 174.854362][ T9784] hfsplus_bnode_dump+0x2ec/0x380 [ 174.854370][ T9784] ? __pfx_hfsplus_bnode_dump+0x10/0x10 [ 174.854377][ T9784] ? hfsplus_bnode_write_u16+0x83/0xb0 [ 174.854385][ T9784] ? srcu_gp_start+0xd0/0x310 [ 174.854393][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854402][ T9784] hfsplus_brec_remove+0x3d2/0x4e0 [ 174.854411][ T9784] __hfsplus_delete_attr+0x290/0x3a0 [ 174.854419][ T9784] ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10 [ 174.854427][ T9784] ? __pfx___hfsplus_delete_attr+0x10/0x10 [ 174.854436][ T9784] ? __asan_memset+0x23/0x50 [ 174.854450][ T9784] hfsplus_delete_all_attrs+0x262/0x320 [ 174.854459][ T9784] ? __pfx_hfsplus_delete_all_attrs+0x10/0x10 [ 174.854469][ T9784] ? rcu_is_watching+0x12/0xc0 [ 174.854476][ T9784] ? __mark_inode_dirty+0x29e/0xe40 [ 174.854483][ T9784] hfsplus_delete_cat+0x845/0xde0 [ 174.854493][ T9784] ? __pfx_hfsplus_delete_cat+0x10/0x10 [ 174.854507][ T9784] hfsplus_unlink+0x1ca/0x7c0 [ 174.854516][ T9784] ? __pfx_hfsplus_unlink+0x10/0x10 [ 174.854525][ T9784] ? down_write+0x148/0x200 [ 174.854532][ T9784] ? __pfx_down_write+0x10/0x10 [ 174.854540][ T9784] vfs_unlink+0x2fe/0x9b0 [ 174.854549][ T9784] do_unlinkat+0x490/0x670 [ 174.854557][ T9784] ? __pfx_do_unlinkat+0x10/0x10 [ 174.854565][ T9784] ? __might_fault+0xbc/0x130 [ 174.854576][ T9784] ? getname_flags.part.0+0x1c5/0x550 [ 174.854584][ T9784] __x64_sys_unlink+0xc5/0x110 [ 174.854592][ T9784] do_syscall_64+0xc9/0x480 [ 174.854600][ T9784] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167 [ 174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08 [ 174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057 [ 174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167 [ 174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50 [ 174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40 [ 174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0 [ 174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 174.854658][ T9784] </TASK> [ 174.854661][ T9784] [ 174.879281][ T9784] Allocated by task 9784: [ 174.879664][ T9784] kasan_save_stack+0x20/0x40 [ 174.880082][ T9784] kasan_save_track+0x14/0x30 [ 174.880500][ T9784] __kasan_kmalloc+0xaa/0xb0 [ 174.880908][ T9784] __kmalloc_noprof+0x205/0x550 [ 174.881337][ T9784] __hfs_bnode_create+0x107/0x890 [ 174.881779][ T9784] hfsplus_bnode_find+0x2d0/0xd10 [ 174.882222][ T9784] hfsplus_brec_find+0x2b0/0x520 [ 174.882659][ T9784] hfsplus_delete_all_attrs+0x23b/0x3 ---truncated---
CVSS3: 7.1
| OS | Vendor version | Errata |
|---|---|---|
| Oracle Linux 7 UEK 6 | 5.4.17-2136.348.3.el7uek | ELSA-2025-20663 |
| Oracle Linux 8 UEK 6 | 5.4.17-2136.348.3.el8uek | ELSA-2025-20663 |
| Debian 11 | 5.10.244-1 | DLA-4327-1 |
| Ubuntu 22.04 | 5.15.0-163.173 | USN-7909-1 |
| Ubuntu 22.04 AWS | 5.15.0-1097.104 | USN-7909-1 |
| Debian 11 cloud | 5.10.244-1 | DLA-4327-1 |
| Debian 12 | 6.1.153-1 | DSA-6009-1 |
| OS | Original kernel version | State |
|---|---|---|
| Oracle Linux 7 UEK 6 |
5.4.17-2011.2.2.el7uek
show all
hide all
5.4.17-2011.1.2.el7uek
5.4.17-2011.3.2.1.el7uek
5.4.17-2011.0.7.el7uek
5.4.17-2011.4.4.el7uek
5.4.17-2011.4.6.el7uek
5.4.17-2011.5.3.el7uek
5.4.17-2011.6.2.el7uek
5.4.17-2011.7.4.el7uek
5.4.17-2036.100.6.1.el7uek
5.4.17-2036.101.2.el7uek
5.4.17-2036.102.0.2.el7uek
5.4.17-2036.103.3.el7uek
5.4.17-2036.103.3.1.el7uek
5.4.17-2036.104.4.el7uek
5.4.17-2036.104.5.el7uek
5.4.17-2102.200.13.el7uek
5.4.17-2102.201.3.el7uek
5.4.17-2102.202.5.el7uek
5.4.17-2102.203.5.el7uek
5.4.17-2102.203.6.el7uek
5.4.17-2102.204.4.2.el7uek
5.4.17-2102.204.4.3.el7uek
5.4.17-2102.204.4.4.el7uek
5.4.17-2102.205.7.2.el7uek
5.4.17-2102.205.7.3.el7uek
5.4.17-2102.206.1.el7uek
5.4.17-2136.300.7.el7uek
5.4.17-2136.301.1.2.el7uek
5.4.17-2136.301.1.4.el7uek
5.4.17-2136.302.6.1.el7uek
5.4.17-2136.302.7.2.el7uek
5.4.17-2136.302.7.2.1.el7uek
5.4.17-2136.301.1.3.el7uek
5.4.17-2136.302.7.2.2.el7uek
5.4.17-2136.302.7.2.3.el7uek
5.4.17-2136.304.4.1.el7uek
5.4.17-2136.304.4.2.el7uek
5.4.17-2136.304.4.3.el7uek
5.4.17-2136.304.4.4.el7uek
5.4.17-2136.304.4.5.el7uek
5.4.17-2136.305.5.3.el7uek
5.4.17-2136.305.5.4.el7uek
5.4.17-2136.305.5.5.el7uek
5.4.17-2136.306.1.3.el7uek
5.4.17-2136.307.3.1.el7uek
5.4.17-2136.307.3.2.el7uek
5.4.17-2136.307.3.4.el7uek
5.4.17-2136.307.3.5.el7uek
5.4.17-2136.308.7.el7uek
5.4.17-2136.307.3.6.el7uek
5.4.17-2136.308.9.el7uek
5.4.17-2136.309.5.el7uek
5.4.17-2136.309.5.1.el7uek
5.4.17-2136.310.7.el7uek
5.4.17-2136.310.7.1.el7uek
5.4.17-2136.309.4.el7uek
5.4.17-2136.311.6.el7uek
5.4.17-2136.311.6.1.el7uek
5.4.17-2136.312.3.4.el7uek
5.4.17-2136.313.6.el7uek
5.4.17-2136.314.6.2.el7uek
5.4.17-2136.314.6.3.el7uek
5.4.17-2136.315.5.el7uek
5.4.17-2136.316.7.el7uek
5.4.17-2136.315.5.8.el7uek
5.4.17-2136.317.5.3.el7uek
5.4.17-2136.317.5.5.el7uek
5.4.17-2136.318.7.1.el7uek
5.4.17-2136.318.7.2.el7uek
5.4.17-2136.319.1.2.el7uek
5.4.17-2136.319.1.3.el7uek
5.4.17-2136.319.1.4.el7uek
5.4.17-2136.320.7.el7uek
5.4.17-2136.320.7.1.el7uek
5.4.17-2136.321.4.el7uek
5.4.17-2136.322.6.2.el7uek
5.4.17-2136.323.8.el7uek
5.4.17-2136.323.8.1.el7uek
5.4.17-2136.323.8.2.el7uek
5.4.17-2136.321.4.1.el7uek
5.4.17-2136.324.5.3.el7uek
5.4.17-2136.322.6.3.el7uek
5.4.17-2136.325.5.el7uek
5.4.17-2136.325.5.1.el7uek
5.4.17-2136.326.6.el7uek
5.4.17-2136.326.6.1.el7uek
5.4.17-2136.327.2.el7uek
5.4.17-2136.328.3.el7uek
5.4.17-2136.329.3.1.el7uek
5.4.17-2136.322.6.4.el7uek
5.4.17-2136.329.3.2.el7uek
5.4.17-2136.330.7.1.el7uek
5.4.17-2136.331.7.el7uek
5.4.17-2136.322.6.5.el7uek
5.4.17-2136.330.7.4.el7uek
5.4.17-2136.332.5.2.el7uek
5.4.17-2136.333.5.el7uek
5.4.17-2136.330.7.5.el7uek
5.4.17-2136.333.5.1.el7uek
5.4.17-2136.334.6.el7uek
5.4.17-2136.334.6.1.el7uek
5.4.17-2136.335.4.el7uek
5.4.17-2136.335.4.1.el7uek
5.4.17-2136.336.5.1.el7uek
5.4.17-2136.337.5.el7uek
5.4.17-2136.337.5.1.el7uek
5.4.17-2136.336.5.3.el7uek
5.4.17-2136.336.5.3.1.el7uek
5.4.17-2136.336.5.3.2.el7uek
5.4.17-2136.338.4.1.el7uek
5.4.17-2136.338.4.2.el7uek
|
Released |
| Oracle Linux 8 UEK 6 |
5.4.17-2011.2.2.el8uek
show all
hide all
5.4.17-2011.1.2.el8uek
5.4.17-2011.3.2.1.el8uek
5.4.17-2011.0.7.el8uek
5.4.17-2011.4.4.el8uek
5.4.17-2011.4.6.el8uek
5.4.17-2011.5.3.el8uek
5.4.17-2011.6.2.el8uek
5.4.17-2011.7.4.el8uek
5.4.17-2036.100.6.1.el8uek
5.4.17-2036.101.2.el8uek
5.4.17-2036.102.0.2.el8uek
5.4.17-2036.103.3.el8uek
5.4.17-2036.103.3.1.el8uek
5.4.17-2036.104.4.el8uek
5.4.17-2036.104.5.el8uek
5.4.17-2102.200.13.el8uek
5.4.17-2102.201.3.el8uek
5.4.17-2102.202.5.el8uek
5.4.17-2102.203.5.el8uek
5.4.17-2102.203.6.el8uek
5.4.17-2102.204.4.2.el8uek
5.4.17-2102.204.4.3.el8uek
5.4.17-2102.204.4.4.el8uek
5.4.17-2102.205.7.2.el8uek
5.4.17-2102.205.7.3.el8uek
5.4.17-2102.206.1.el8uek
5.4.17-2136.300.7.el8uek
5.4.17-2136.301.1.2.el8uek
5.4.17-2136.301.1.4.el8uek
5.4.17-2136.302.6.1.el8uek
5.4.17-2136.302.7.2.el8uek
5.4.17-2136.302.7.2.1.el8uek
5.4.17-2136.301.1.3.el8uek
5.4.17-2136.302.7.2.2.el8uek
5.4.17-2136.302.7.2.3.el8uek
5.4.17-2136.304.4.1.el8uek
5.4.17-2136.304.4.2.el8uek
5.4.17-2136.304.4.3.el8uek
5.4.17-2136.304.4.4.el8uek
5.4.17-2136.304.4.5.el8uek
5.4.17-2136.305.5.3.el8uek
5.4.17-2136.305.5.4.el8uek
5.4.17-2136.305.5.5.el8uek
5.4.17-2136.306.1.3.el8uek
5.4.17-2136.307.3.1.el8uek
5.4.17-2136.307.3.2.el8uek
5.4.17-2136.307.3.4.el8uek
5.4.17-2136.307.3.5.el8uek
5.4.17-2136.308.7.el8uek
5.4.17-2136.307.3.6.el8uek
5.4.17-2136.308.9.el8uek
5.4.17-2136.309.5.el8uek
5.4.17-2136.309.5.1.el8uek
5.4.17-2136.310.7.el8uek
5.4.17-2136.310.7.1.el8uek
5.4.17-2136.309.4.el8uek
5.4.17-2136.311.6.el8uek
5.4.17-2136.311.6.1.el8uek
5.4.17-2136.312.3.4.el8uek
5.4.17-2136.313.6.el8uek
5.4.17-2136.314.6.2.el8uek
5.4.17-2136.314.6.3.el8uek
5.4.17-2136.315.5.el8uek
5.4.17-2136.316.7.el8uek
5.4.17-2136.315.5.8.el8uek
5.4.17-2136.317.5.3.el8uek
5.4.17-2136.317.5.5.el8uek
5.4.17-2136.318.7.1.el8uek
5.4.17-2136.318.7.2.el8uek
5.4.17-2136.319.1.2.el8uek
5.4.17-2136.319.1.3.el8uek
5.4.17-2136.319.1.4.el8uek
5.4.17-2136.320.7.el8uek
5.4.17-2136.320.7.1.el8uek
5.4.17-2136.321.4.el8uek
5.4.17-2136.321.4.1.el8uek
5.4.17-2136.322.6.2.el8uek
5.4.17-2136.323.8.el8uek
5.4.17-2136.323.8.1.el8uek
5.4.17-2136.323.8.2.el8uek
5.4.17-2136.324.5.2.el8uek
5.4.17-2136.324.5.3.el8uek
5.4.17-2136.322.6.3.el8uek
5.4.17-2136.325.5.el8uek
5.4.17-2136.325.5.1.el8uek
5.4.17-2136.326.6.el8uek
5.4.17-2136.326.6.1.el8uek
5.4.17-2136.327.2.el8uek
5.4.17-2136.328.3.el8uek
5.4.17-2136.329.3.1.el8uek
5.4.17-2136.322.6.4.el8uek
5.4.17-2136.329.3.2.el8uek
5.4.17-2136.330.7.1.el8uek
5.4.17-2136.331.7.el8uek
5.4.17-2136.322.6.5.el8uek
5.4.17-2136.330.7.4.el8uek
5.4.17-2136.332.5.2.el8uek
5.4.17-2136.333.5.el8uek
5.4.17-2136.330.7.5.el8uek
5.4.17-2136.333.5.1.el8uek
5.4.17-2136.334.6.el8uek
5.4.17-2136.334.6.1.el8uek
5.4.17-2136.335.4.el8uek
5.4.17-2136.335.4.1.el8uek
5.4.17-2136.336.5.1.el8uek
5.4.17-2136.337.5.el8uek
5.4.17-2136.337.5.1.el8uek
5.4.17-2136.336.5.3.el8uek
5.4.17-2136.336.5.3.1.el8uek
5.4.17-2136.336.5.3.2.el8uek
5.4.17-2136.338.4.1.el8uek
5.4.17-2136.338.4.2.el8uek
5.4.17-2136.339.5.el8uek
5.4.17-2136.339.5.1.el8uek
5.4.17-2136.339.5.2.el8uek
5.4.17-2136.340.4.1.el8uek
5.4.17-2136.341.3.3.el8uek
5.4.17-2136.341.3.1.el8uek
5.4.17-2136.342.5.el8uek
5.4.17-2136.342.5.3.el8uek
5.4.17-2136.343.5.1.el8uek
5.4.17-2136.344.4.1.el8uek
5.4.17-2136.343.5.3.el8uek
5.4.17-2136.344.4.3.el8uek
5.4.17-2136.345.5.3.el8uek
5.4.17-2136.346.6.el8uek
5.4.17-2136.343.5.5.el8uek
5.4.17-2136.347.6.el8uek
5.4.17-2136.347.6.1.el8uek
5.4.17-2136.347.6.2.el8uek
5.4.17-2136.347.6.3.el8uek
5.4.17-2136.343.5.6.el8uek
5.4.17-2136.347.6.4.el8uek
|
Released |
| Debian 11 |
5.10.46-5
show all
hide all
5.10.70-1
5.10.46-4
5.10.84-1
5.10.92-1
5.10.92-2
5.10.103-1
5.10.106-1
5.10.113-1
5.10.120-1
5.10.127-1
5.10.127-2
5.10.136-1
5.10.140-1
5.10.149-1
5.10.149-2
5.10.158-2
5.10.162-1
5.10.179-1
5.10.179-2
5.10.179-3
5.10.179-5
5.10.191-1
5.10.197-1
5.10.178-3
5.10.205-2
5.10.205-1
5.10.209-2
5.10.216-1
5.10.218-1
5.10.221-1
5.10.223-1
5.10.226-1
5.10.234-1
5.10.237-1
|
Released |
| Ubuntu 22.04 | |
Planned |
| Ubuntu 22.04 AWS | |
Planned |
| Debian 11 cloud |
5.10.113-1
show all
hide all
5.10.179-2
5.10.179-3
5.10.179-5
5.10.191-1
5.10.197-1
5.10.205-2
5.10.209-2
5.10.216-1
5.10.218-1
5.10.221-1
5.10.223-1
5.10.226-1
5.10.234-1
5.10.237-1
|
Released |
| Debian 12 |
6.1.38-1
show all
hide all
6.1.38-2
6.1.38-4
6.1.52-1
6.1.55-1
6.1.64-1
6.1.66-1
6.1.69-1
6.1.76-1
6.1.27-1
6.1.67-1
6.1.85-1
6.1.90-1
6.1.94-1
6.1.99-1
6.1.106-3
6.1.112-1
6.1.115-1
6.1.119-1
6.1.123-1
6.1.128-1
6.1.124-1
6.1.129-1
6.1.133-1
6.1.135-1
6.1.137-1
6.1.140-1
6.1.139-1
6.1.147-1
|
Released |