Linux Kernel Squashfs Module Integer Underflow Vulnerability Leading to Null Pointer Dereference and Out-of-Bounds Access

A vulnerability in the Linux kernel's Squashfs module can lead to a null pointer dereference or out-of-bounds access. This issue arises when mounting a corrupted filesystem, causing a signed integer, '*xattr_ids', to become negative. The negative value disrupts the calculation of 'len' and 'indexes', which can result in a null pointer dereference in the 'copy_bio_to_actor()' function or out-of-bounds accesses during subsequent sanity checks in 'squashfs_read_xattr_id_table()'. This vulnerability was discovered by the Linux Verification Center using Syzkaller.

Impact

Exploitation of this vulnerability can lead to a null pointer dereference or out-of-bounds access, both of which can cause a system crash or potentially be exploited to execute arbitrary code.