Skip to content

fs: fix kernel-infoleak CVE-2024-26901 and uninitialized field CVE-2024-26973

Andrey Albershteyn requested to merge alberand-rh/centos-stream-9:rhel9_33188 into main

JIRA: https://issues.redhat.com/browse/RHEL-33188 JIRA: https://issues.redhat.com/browse/RHEL-35110 CVE: CVE-2024-26901 CVE: CVE-2024-26973

The MR includes two commits. The f3e9b4a5 is direct fix for the syzbot CVE report. The ce1f9441 is fix for slightly different syzbot report but looks to be addressing the same issue. Both of them can fix the CVE-2024-26901. The latter one also fixes another CVE-2024-26973.

ce1f9441 ("fat: fix uninitialized field in nostale filehandles") f3e9b4a5 ("do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak")

syzbot for 299be15ac284: https://lore.kernel.org/all/000000000000b6ffa9060ee52c74@google.com/ syzbot for 44fa6ae60b98: https://lore.kernel.org/all/000000000000e3d83a060ee5285a@google.com/

Signed-off-by: Andrey Albershteyn aalbersh@redhat.com

Merge request reports