https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:45:02 +0000 https://vulnerability.circl.lu/vuln/cve-2022-49762 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntfs: check overflow when iterating ATTR_RECORDs</p> <p>Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). Because the ATTR_RECORDs are next to each other, kernel can get the next ATTR_RECORD from end address of current ATTR_RECORD, through current ATTR_RECORD length field.</p> <p>The problem is that during iteration, when kernel calculates the end address of current ATTR_RECORD, kernel may trigger an integer overflow bug in executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a-&gt;length))`. This may wrap, leading to a forever iteration on 32bit systems.</p> <p>This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>ntfs: check overflow when iterating ATTR_RECORDs</p> <p>Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). Because the ATTR_RECORDs are next to each other, kernel can get the next ATTR_RECORD from end address of current ATTR_RECORD, through current ATTR_RECORD length field.</p> <p>The problem is that during iteration, when kernel calculates the end address of current ATTR_RECORD, kernel may trigger an integer overflow bug in executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a-&gt;length))`. This may wrap, leading to a forever iteration on 32bit systems.</p> <p>This patch solves it by adding some checks on calculating end address of current ATTR_RECORD during iteration.</p> https://vulnerability.circl.lu/vuln/cve-2022-49762