CVE-2022-49762

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ntfs: check overflow when iterating ATTR_RECORDs<br /> <br /> Kernel iterates over ATTR_RECORDs in mft record in ntfs_attr_find(). <br /> Because the ATTR_RECORDs are next to each other, kernel can get the next<br /> ATTR_RECORD from end address of current ATTR_RECORD, through current<br /> ATTR_RECORD length field.<br /> <br /> The problem is that during iteration, when kernel calculates the end<br /> address of current ATTR_RECORD, kernel may trigger an integer overflow bug<br /> in executing `a = (ATTR_RECORD*)((u8*)a + le32_to_cpu(a-&gt;length))`. This<br /> may wrap, leading to a forever iteration on 32bit systems.<br /> <br /> This patch solves it by adding some checks on calculating end address<br /> of current ATTR_RECORD during iteration.