In the Linux kernel, the following vulnerability has been resolved:
xfs: don't swallow dquot recovery verification errors
xlog_recover_dquot_commit_pass2() validates the recovered dquot with
xfs_dqblk_verify() and, on failure, sets error = -EFSCORRUPTED and jumps
to out_release. But out_release unconditionally returns 0, so the
corruption error is discarded: the caller xlog_recover_items_pass2()
sees success, log recovery proceeds as if the dquot were valid, and the
corrupt quota buffer can be written back to disk.
from 7880b1f0adef4d363f42d6bb42aab3211291351b before e506e127fcb4e2bad1045805f1740b395eea9618; 3581868f51a2edb027a898988b5b5a4ba379ee55 builds before 5b756fbb60b5d26063f46a11a3c7daa7eb616d79; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before a233b3362a3c7bf23f5143b4ef4b17ec337fcb4d; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before 38a4dbe588bd028a07a77dc5cee62ee3ce21e87d; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before 36a31b12540c0a0a3b77a01fda86de646f2961fb; from 9c235dfc3d3f901fe22acb20f2ab37ff39f2ce02 before e2b4a856085e9bd939bde2dee0d08b1d41babde9; from 6.1.128 before 6.1.184; from 6.6.17 before 6.6.153
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
