Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: cifs: call pagecache_isize_extended() in cifs_setsize() when extending cifs_setsize() calls truncate_pagecache() but skips pagecache_isize_extended() on extension. truncate_setsize() shows the correct pattern: i_size_write(inode, newsize); if (newsize > oldsize) pagecache_isize_extended(inode, oldsize, newsize); truncate_pagecache(inode, newsize); pagecache_isize_extended() zeroes the tail of the page straddling old EOF. Without it, dirty bytes in that region can be written back to the server, exposing stale data in the newly extended range.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5463d96cd2e46064ceefcf861b028745a4f4c373; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 40c16040783abcc240bd1b453e679ea6ca30e19e; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e1f692b6da3e632a25d0b3a99f833bb609bae1a3; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 12bafe32f09c0d24f5096154b59c347b9c6606e0; affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c510edb9734af1c274d18f4f31a471a166bbc7e8 |
| Linux / Linux | affected 2.6.12; unaffected 0 before 2.6.12; unaffected 6.6.160 through 6.6.*; unaffected 6.12.114 through 6.12.*; unaffected 6.18.57 through 6.18.*; unaffected 7.2.4 through 7.2.*; unaffected 7.3 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/5463d96cd2e46064ceefcf861b028745a4f4c373
- https://git.kernel.org/stable/c/40c16040783abcc240bd1b453e679ea6ca30e19e
- https://git.kernel.org/stable/c/e1f692b6da3e632a25d0b3a99f833bb609bae1a3
- https://git.kernel.org/stable/c/12bafe32f09c0d24f5096154b59c347b9c6606e0
- https://git.kernel.org/stable/c/c510edb9734af1c274d18f4f31a471a166bbc7e8