ocfs2: fix data corruption after failed write (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.21 % · centile 12 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Analyzed
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix data corruption after failed write When buffered write fails to copy data into underlying page cache page, ocfs2_write_end_nolock() just zeroes out and dirties the page. This can leave dirty page beyond EOF and if page writeback tries to write this page before write succeeds and expands i_size, page gets into inconsistent state where page dirty bit is clear but buffer dirty bits stay set resulting in page data never getting written and so data copied to the page is lost. Fix the problem by invalidating page beyond EOF after failed write.
Faiblesses (CWE)
- CWE-787 — Écriture hors limites
Références
- https://git.kernel.org/stable/c/1629f6f522b2d058019710466a84b240683bbee3
- https://git.kernel.org/stable/c/c26f3ff4c0be590c1250f945ac2e4fc5fcdc5f45
- https://git.kernel.org/stable/c/4c24eb49ab44351424ac8fe8567f91ea48a06089
- https://git.kernel.org/stable/c/91d7a4bd5656552d6259e2d0f8859f9e8cc5ef68
- https://git.kernel.org/stable/c/a9e53869cb43c96d6d851c491fd4e26430ab6ba6
- https://git.kernel.org/stable/c/47eb055ad3588fc96d34e9e1dd87b210ce62906b
- https://git.kernel.org/stable/c/205759c6c18f54659b0b5976b14a52d1b3eb9f57
- https://git.kernel.org/stable/c/90410bcf873cf05f54a32183afff0161f44f9715
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2025-13180
- GCVE · GCVE-0-2023-53081
Avis du CERT-FR
- CERTFR-2026-AVI-0081 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-1009 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0607 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0587 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0560 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0529 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0509 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.9.242 < 4.10cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.14.204 < 4.14.312cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.155 < 4.19.280cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.75 < 5.4.240cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.9.5 < 5.10.177cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.105cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 6.1.21cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.2 < 6.2.8cpe:2.3:o:linux:linux_kernel:6.3:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.3:rc2:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 7ed80e77c908cbaa686529a49f8ae0060c5caee7 < 1629f6f522b2d058019710466a84b240683bbee3 ; affected 7ce2b16bad2cbfa3fa7bbc42c4448914f639ca47 < c26f3ff4c0be590c1250f945ac2e4fc5fcdc5f45 ; affected f8a6a2ed4b7d1c3c8631eeb6d00572bc853094a8 < 4c24eb49ab44351424ac8fe8567f91ea48a06089 ; affected 6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b < 91d7a4bd5656552d6259e2d0f8859f9e8cc5ef68 ; affected 6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b < a9e53869cb43c96d6d851c491fd4e26430ab6ba6 ; affected 6dbf7bb555981fb5faf7b691e8f6169fc2b2e63b < 47eb055ad3588fc96d34e9e1dd87b210ce62906b |
| Linux · Linux | affected 5.10 ; unaffected 0 < 5.10 ; unaffected 4.14.312 ≤ 4.14.* ; unaffected 4.19.280 ≤ 4.19.* ; unaffected 5.4.240 ≤ 5.4.* ; unaffected 5.10.177 ≤ 5.10.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |