Executive Summary

This vulnerability exists in the Linux kernel's md/raid5 component, specifically in how it handles journal metadata payload sizes. Functions r5c_recovery_analyze_meta_block() and r5l_recovery_verify_data_checksum_for_mb() iterate over payloads using on-disk payload size fields without validating these sizes against the remaining space in the metadata block.

If the journal is corrupted and contains payload sizes that extend beyond the PAGE_SIZE boundary, this can lead to out-of-bounds reads when accessing payload fields or computing offsets. The fix involves adding bounds validation for each payload type to ensure the full payload fits within the metadata size before processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause out-of-bounds reads in the Linux kernel when processing corrupted RAID5 journal metadata. Such out-of-bounds reads may lead to system instability, crashes, or potentially expose sensitive kernel memory contents, which could be exploited by attackers to compromise system security.

Useful 0 Not Useful 0