Executive Summary

This vulnerability exists in the Linux kernel's FUSE (Filesystem in Userspace) implementation. Specifically, the function fuse_add_dirent_to_cache() calculates the size of directory entries (dirents) based on a server-controlled name length field (namelen) and copies these entries into a page cache.

The problem is that the function only checks if the dirent fits in the remaining space of the current page and moves to a new page if it doesn't, but it never verifies if the dirent itself is larger than the entire page size (PAGE_SIZE).

A malicious FUSE server can exploit this by sending a dirent with a very large namelen (e.g., 4095), resulting in a serialized record size of 4120 bytes. On systems with 4 KiB pages, this causes a buffer overflow of 24 bytes beyond the intended page boundary into the next kernel page.

The fix involves rejecting dirents that cannot fit entirely within a single page before copying them into the readdir cache, preventing this overflow.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a buffer overflow in the kernel's page cache when processing directory entries from a FUSE server. Such an overflow may corrupt adjacent kernel memory pages.

Potential impacts include system instability, crashes, or exploitation by an attacker to execute arbitrary code with kernel privileges, leading to a full system compromise.

Since the vulnerability is triggered by a malicious FUSE server, systems that mount or interact with untrusted FUSE filesystems are particularly at risk.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability has been resolved by rejecting dirents that cannot fit in a single page before copying them into the readdir cache.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0