Executive Summary

This vulnerability exists in the Linux kernel's omfs filesystem code. Specifically, the function omfs_fill_super() properly rejects s_sys_blocksize values that are larger than PAGE_SIZE, but it does not reject values smaller than OMFS_DIR_START (440).

Because s_sys_blocksize is an unsigned 32-bit integer, if a crafted filesystem image sets s_sys_blocksize to a value smaller than OMFS_DIR_START, an unsigned underflow occurs when omfs_make_empty() calculates the length argument for memset(). This causes memset() to overwrite approximately 4 GiB of kernel memory beyond the intended buffer, potentially corrupting kernel memory.

The fix involves adding a lower-bound check in omfs_fill_super() to reject malformed filesystem images before any data is processed.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a large memory overwrite in kernel space, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges.

Because the vulnerability involves overwriting kernel memory far beyond the intended buffer, it can be exploited by an attacker who can supply a crafted filesystem image, potentially leading to privilege escalation or denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the fix has been applied. The fix involves adding a lower-bound check in the omfs_fill_super() function to reject malformed OMFS filesystem images with s_sys_blocksize values smaller than OMFS_DIR_START, preventing unsafe memory operations.

Avoid mounting untrusted or crafted OMFS filesystem images that could exploit this vulnerability until the kernel is patched.

Useful 0 Not Useful 0