In the Linux kernel, the following vulnerability has been resolved:
ocfs2: reject FITRIM ranges shorter than a cluster
ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its
too-short range validation only checks sb->s_blocksize. On filesystems with a cluster size larger than the block size, a FITRIM
range that is at least one block but shorter than one cluster is accepted
and shifted down to len == 0. The later start + len - 1 and len -= ...
arithmetic then underflows and can drive trimming past the requested
range.
Reject ranges shorter than s_clustersize instead. That preserves the
existing -EINVAL behavior for requests that cannot discard even one
allocation unit and keeps zero-cluster trims out of the group walk.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 8
https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd
416baaa9-dc9f-4396-8d5f-8c081fb06d67