diff --git a/advisories/unreviewed/2025/03/GHSA-592q-r679-2jpc/GHSA-592q-r679-2jpc.json b/advisories/unreviewed/2025/03/GHSA-592q-r679-2jpc/GHSA-592q-r679-2jpc.json index 407baa0ff7f51..6233cb021b477 100644 --- a/advisories/unreviewed/2025/03/GHSA-592q-r679-2jpc/GHSA-592q-r679-2jpc.json +++ b/advisories/unreviewed/2025/03/GHSA-592q-r679-2jpc/GHSA-592q-r679-2jpc.json @@ -6,14 +6,32 @@ "aliases": [ "CVE-2023-52979" ], - "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nsquashfs: harden sanity check in squashfs_read_xattr_id_table\n\nWhile mounting a corrupted filesystem, a signed integer '*xattr_ids' can\nbecome less than zero. This leads to the incorrect computation of 'len'\nand 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor()\nor out-of-bounds accesses in the next sanity checks inside\nsquashfs_read_xattr_id_table().\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.", + "summary": "xattr_ids overflow potentially causing null-ptr-deref", + "details": "In the Linux kernel, the following vulnerability was identified:\n\nsquashfs: harden sanity check in squashfs_read_xattr_id_table\n\nWhile mounting a corrupted filesystem, a signed integer '*xattr_ids' can\nbecome less than zero. This leads to the incorrect computation of 'len'\nand 'indexes' values which can cause null-ptr-deref in copy_bio_to_actor()\nor out-of-bounds accesses in the next sanity checks inside\nsquashfs_read_xattr_id_table().\n\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.\n\nA patch was proposed to fix the vulnerability, however it was later reverted. This vulnerability remains unpatched.\n\n", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H" } ], - "affected": [], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + } + ] + } + ] + } + ], "references": [ { "type": "ADVISORY", @@ -27,6 +45,10 @@ "type": "WEB", "url": "https://git.kernel.org/stable/c/72e544b1b28325fe78a4687b980871a7e4101f76" }, + { + "type": "WEB", + "url": "https://git.kernel.org/stable/c/a5b21d8d791cd4db609d0bbcaa9e0c7e019888d1" + }, { "type": "WEB", "url": "https://git.kernel.org/stable/c/b30a74f83265c24d1d0842c6c3928cd2e775a3fb" @@ -46,6 +68,10 @@ { "type": "WEB", "url": "https://git.kernel.org/stable/c/de2785aa3448d1ee7be3ab47fd4a873025f1b3d7" + }, + { + "type": "WEB", + "url": "https://lore.kernel.org/all/68f15d67-8945-2728-1f17-5b53a80ec52d@squashfs.org.uk/T/#u" } ], "database_specific": {