Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 916507 (CVE-2023-45897) - <sys-fs/exfatprogs-1.2.2: OOB read
Summary: <sys-fs/exfatprogs-1.2.2: OOB read
Status: IN_PROGRESS
Alias: CVE-2023-45897
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://github.com/exfatprogs/exfatpr...
Whiteboard: B4 [stable?]
Keywords:
Depends on:
Blocks:
 
Reported: 2023-10-29 21:14 UTC by John Helmert III
Modified: 2023-11-30 04:12 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-10-29 21:14:10 UTC 
CVE-2023-45897:

exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.

Seemingly in fsck.exfat, fix is in 1.2.2 according to release
notes. Please bump.
Comment 1 Larry the Git Cow gentoo-dev 2023-11-30 04:08:38 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a4659b0e2e29cd636376fc58b1e256ed3b3ea366

commit a4659b0e2e29cd636376fc58b1e256ed3b3ea366
Author:     Sam James <sam@gentoo.org>
AuthorDate: 2023-11-30 04:07:53 +0000
Commit:     Sam James <sam@gentoo.org>
CommitDate: 2023-11-30 04:07:53 +0000

    sys-fs/exfatprogs: add 1.2.2
    
    Bug: https://bugs.gentoo.org/916507
    Signed-off-by: Sam James <sam@gentoo.org>

 sys-fs/exfatprogs/Manifest                |  1 +
 sys-fs/exfatprogs/exfatprogs-1.2.2.ebuild | 25 +++++++++++++++++++++++++
 sys-fs/exfatprogs/exfatprogs-9999.ebuild  |  4 ++--
 3 files changed, 28 insertions(+), 2 deletions(-)