Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:EOL][EOL]hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read()[EOL][EOL]The hfsplus_bnode_read() method can trigger the issue:[EOL][EOL][  174.852007][ T9784] ==================================================================[EOL][  174.852709][ T9784] BUG: KASAN: slab-out-of-bounds in hfsplus_bnode_read+0x2f4/0x360[EOL][  174.853412][ T9784] Read of size 8 at addr ffff88810b5fc6c0 by task repro/9784[EOL][  174.854059][ T9784][EOL][  174.854272][ T9784] CPU: 1 UID: 0 PID: 9784 Comm: repro Not tainted 6.16.0-rc3 #7 PREEMPT(full)[EOL][  174.854281][ T9784] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014[EOL][  174.854286][ T9784] Call Trace:[EOL][  174.854289][ T9784]  <TASK>[EOL][  174.854292][ T9784]  dump_stack_lvl+0x10e/0x1f0[EOL][  174.854305][ T9784]  print_report+0xd0/0x660[EOL][  174.854315][ T9784]  ? __virt_addr_valid+0x81/0x610[EOL][  174.854323][ T9784]  ? __phys_addr+0xe8/0x180[EOL][  174.854330][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360[EOL][  174.854337][ T9784]  kasan_report+0xc6/0x100[EOL][  174.854346][ T9784]  ? hfsplus_bnode_read+0x2f4/0x360[EOL][  174.854354][ T9784]  hfsplus_bnode_read+0x2f4/0x360[EOL][  174.854362][ T9784]  hfsplus_bnode_dump+0x2ec/0x380[EOL][  174.854370][ T9784]  ? __pfx_hfsplus_bnode_dump+0x10/0x10[EOL][  174.854377][ T9784]  ? hfsplus_bnode_write_u16+0x83/0xb0[EOL][  174.854385][ T9784]  ? srcu_gp_start+0xd0/0x310[EOL][  174.854393][ T9784]  ? __mark_inode_dirty+0x29e/0xe40[EOL][  174.854402][ T9784]  hfsplus_brec_remove+0x3d2/0x4e0[EOL][  174.854411][ T9784]  __hfsplus_delete_attr+0x290/0x3a0[EOL][  174.854419][ T9784]  ? __pfx_hfs_find_1st_rec_by_cnid+0x10/0x10[EOL][  174.854427][ T9784]  ? __pfx___hfsplus_delete_attr+0x10/0x10[EOL][  174.854436][ T9784]  ? __asan_memset+0x23/0x50[EOL][  174.854450][ T9784]  hfsplus_delete_all_attrs+0x262/0x320[EOL][  174.854459][ T9784]  ? __pfx_hfsplus_delete_all_attrs+0x10/0x10[EOL][  174.854469][ T9784]  ? rcu_is_watching+0x12/0xc0[EOL][  174.854476][ T9784]  ? __mark_inode_dirty+0x29e/0xe40[EOL][  174.854483][ T9784]  hfsplus_delete_cat+0x845/0xde0[EOL][  174.854493][ T9784]  ? __pfx_hfsplus_delete_cat+0x10/0x10[EOL][  174.854507][ T9784]  hfsplus_unlink+0x1ca/0x7c0[EOL][  174.854516][ T9784]  ? __pfx_hfsplus_unlink+0x10/0x10[EOL][  174.854525][ T9784]  ? down_write+0x148/0x200[EOL][  174.854532][ T9784]  ? __pfx_down_write+0x10/0x10[EOL][  174.854540][ T9784]  vfs_unlink+0x2fe/0x9b0[EOL][  174.854549][ T9784]  do_unlinkat+0x490/0x670[EOL][  174.854557][ T9784]  ? __pfx_do_unlinkat+0x10/0x10[EOL][  174.854565][ T9784]  ? __might_fault+0xbc/0x130[EOL][  174.854576][ T9784]  ? getname_flags.part.0+0x1c5/0x550[EOL][  174.854584][ T9784]  __x64_sys_unlink+0xc5/0x110[EOL][  174.854592][ T9784]  do_syscall_64+0xc9/0x480[EOL][  174.854600][ T9784]  entry_SYSCALL_64_after_hwframe+0x77/0x7f[EOL][  174.854608][ T9784] RIP: 0033:0x7f6fdf4c3167[EOL][  174.854614][ T9784] Code: f0 ff ff 73 01 c3 48 8b 0d 26 0d 0e 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 08[EOL][  174.854622][ T9784] RSP: 002b:00007ffcb948bca8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057[EOL][  174.854630][ T9784] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f6fdf4c3167[EOL][  174.854636][ T9784] RDX: 00007ffcb948bcc0 RSI: 00007ffcb948bcc0 RDI: 00007ffcb948bd50[EOL][  174.854641][ T9784] RBP: 00007ffcb948cd90 R08: 0000000000000001 R09: 00007ffcb948bb40[EOL][  174.854645][ T9784] R10: 00007f6fdf564fc0 R11: 0000000000000206 R12: 0000561e1bc9c2d0[EOL][  174.854650][ T9784] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000[EOL][  174.854658][ T9784]  </TASK>[EOL][  174.854661][ T9784][EOL][  174.879281][ T9784] Allocated by task 9784:[EOL][  174.879664][ T9784]  kasan_save_stack+0x20/0x40[EOL][  174.880082][ T9784]  kasan_save_track+0x14/0x30[EOL][  174.880500][ T9784]  __kasan_kmalloc+0xaa/0xb0[EOL][  174.880908][ T9784]  __kmalloc_noprof+0x205/0x550[EOL][  174.881337][ T9784]  __hfs_bnode_create+0x107/0x890[EOL][  174.881779][ T9784]  hfsplus_bnode_find+0x2d0/0xd10[EOL][  174.882222][ T9784]  hfsplus_brec_find+0x2b0/0x520[EOL][  174.882659][ T9784]  hfsplus_delete_all_attrs+0x23b/0x3[EOL]---truncated---

CREATE(Triage):(User=admin) [CVE-2025-38714 (https://nvd.nist.gov/vuln/detail/CVE-2025-38714)