FAT Filesystem Link Count Underflow in Linux Kernel

Executive Summary

This vulnerability exists in the Linux kernel's handling of FAT filesystems. Specifically, corrupted FAT images can cause a directory inode to have an incorrect link count (i_nlink), such as showing 2 even though subdirectories exist. When the rmdir operation is called, it unconditionally decreases the parent directory's link count using drop_nlink(dir). This can reduce the link count to zero, which triggers a warning (WARN_ON) in the kernel.

The fix involves adding a sanity check in the vfat_rmdir() and msdos_rmdir() functions to only decrease the parent link count if it is at least 3. If the link count is less than 3, the operation reports a filesystem error instead of decreasing the count.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to incorrect filesystem behavior when removing directories on FAT filesystems with corrupted images. Specifically, it can cause the directory link count to underflow, triggering kernel warnings and potentially destabilizing the filesystem state.

While the description does not explicitly mention security impacts such as privilege escalation or data loss, the filesystem errors and warnings could lead to system instability or unexpected behavior when managing directories.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is resolved by adding a sanity check in the Linux kernel's vfat_rmdir() and msdos_rmdir() functions to prevent parent link count underflow in rmdir operations on FAT filesystems.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes this fix.

Useful 0 Not Useful 0