Executive Summary

This vulnerability exists in the Linux kernel's EROFS filesystem implementation. It involves improper handling of the 'nameoff' field for trailing directory entries (dirents). Although boundary checks exist for nameoffs, trailing dirents are special because their name lengths are calculated using strnlen() without verifying the nameoff value. If a crafted EROFS filesystem contains a trailing dirent with a nameoff greater than or equal to the maximum size, an underflow can occur when calculating maxsize - nameoff. This causes strnlen() to read beyond the directory block, potentially leading to out-of-bounds memory access.

Additionally, the nameoff0 value should be verified to be a multiple of the size of the erofs_dirent structure to prevent improper memory access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads in the Linux kernel when processing specially crafted EROFS filesystems. Such out-of-bounds reads may cause system instability, crashes, or potentially expose sensitive kernel memory contents. This could be exploited by an attacker to gain information about the system or cause denial of service.

Useful 0 Not Useful 0