Executive Summary

This vulnerability exists in the Linux kernel's handling of UDF (Universal Disk Format) images. Specifically, when mounting a crafted UDF image containing repeated partition descriptors, a heap out-of-bounds write can occur in the part_descs_loc[] array.

The function handle_partition_descriptor() attempts to deduplicate partition descriptors by partition number, but the appended slots do not record the partition number (partnum). This causes duplicate partition descriptors to be appended repeatedly, increasing the count num_part_descs indefinitely.

When the table is full, the allocation size is still based on partnum, but inserts are indexed by num_part_descs. If partnum is aligned to a certain step size, the allocation capacity does not increase, leading to writes beyond the end of the table (heap out-of-bounds write).

The fix involves storing the partition number in the appended slot and sizing growth based on the next append count, ensuring deduplication and capacity tracking are consistent.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a heap out-of-bounds write when mounting a maliciously crafted UDF image with repeated partition descriptors.

Such a heap out-of-bounds write can cause memory corruption, which may result in system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges.

Therefore, an attacker could exploit this vulnerability to compromise the security and stability of a system running the affected Linux kernel.

Useful 0 Not Useful 0