Executive Summary

This vulnerability exists in the Linux kernel's HFS+ filesystem implementation. Specifically, the function hfs_bnode_create() can return an existing node without increasing its reference count if it finds that the node is already hashed, which should not normally happen. This causes a reference count inconsistency that eventually leads to a kernel panic when the node is freed later.

The problem arises when hfs_bmap_alloc() tries to allocate a node that is already in use, possibly due to filesystem corruption or an incorrect bitmap state. Instead of returning the existing node, the fix changes the function to return an error pointer signaling that the node already exists, preventing the reference count issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a kernel panic, which is a system crash, leading to denial of service. If triggered, it can cause the Linux system to become unstable or unresponsive, requiring a reboot and potentially causing data loss or disruption of services running on the affected system.

Useful 0 Not Useful 0

Mitigation Strategies

This vulnerability occurs due to a reference count inconsistency in the hfsplus filesystem code of the Linux kernel, which can lead to a kernel panic.

To mitigate this vulnerability, you should update your Linux kernel to a version where this issue is fixed. The fix involves returning an error pointer (ERR_PTR(-EEXIST)) when a node already exists instead of returning the existing node, preventing the reference count inconsistency.

Additionally, check for filesystem corruption on HFS+ volumes, as corruption can trigger this issue. Running filesystem repair tools on affected volumes may help prevent the problem.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability manifests as a kernel panic caused by a reference count inconsistency in the hfsplus filesystem code, specifically in hfs_bnode_create and hfs_bnode_put functions.

To detect this vulnerability on your system, you should monitor your system logs for kernel panic messages related to hfsplus, such as:

• kernel BUG at fs/hfsplus/bnode.c:676!
• BUG_ON(!atomic_read(&node->refcnt))

You can use commands like the following to check for such messages in your kernel logs:

• dmesg | grep -i hfsplus
• journalctl -k | grep -i hfsplus

Additionally, since the issue may be caused by filesystem corruption or incorrect bitmap bits, running filesystem checks on the affected HFS+ partitions may help detect underlying problems.

Useful 0 Not Useful 0