CVE-2023-45897

The exfatprogs package contains utilities for formatting and repairing exFAT filesystems.

Security Fix(es):

• exfatprogs: exfatprogs allows out-of-bounds memory access (CVE-2023-45897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.

exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.

The exfatprogs package contains utilities for formatting and repairing exFAT filesystems.

Security Fix(es):

• exfatprogs: exfatprogs allows out-of-bounds memory access (CVE-2023-45897)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2023-45897: fix out-of-bounds write in read_file_dentry_set when SecondaryCount exceeds the maximum number of File Name entries

exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set.

exfatprogs before 1.2.2 allows out-of-bounds memory access, such as in read_file_dentry_set. (CVE-2023-45897)

This update for exfatprogs fixes the following issues:

• CVE-2023-45897: Fixed out-of-bound memory issues in fsck (bsc#1216701).

It was discovered that exfatprogs incorrectly handled certain memory operations. If a user or automated system were tricked into handling specially crafted exfat partitions, a remote attacker could use this issue to cause exfatprogs to crash, resulting in a denial of service, or possibly execute arbitrary code.