Linux Kernel HFS/HFSPlus Slab-Out-Of-Bounds Vulnerability

A slab-out-of-bounds vulnerability has been identified in the Linux kernel's HFS/HFSPlus file system. This issue arises in the 'hfs_bnode_read_key' function, where an invalid key length can lead to out-of-bounds memory access. The vulnerability was reported by Syzbot and is related to memory handling in high-memory pages.

Impact

Exploitation of this vulnerability can lead to out-of-bounds memory access, potentially causing memory corruption.

Reproduction

The vulnerability can be reproduced by creating a directory using the 'mkdir' system call in a file system that uses HFS or HFSPlus. The 'hfs_mkdir' function will be called, which triggers the vulnerability by passing an invalid key length to the 'hfs_bnode_read_key' function, causing a slab-out-of-bounds memory access.

Remediation

Users are advised to update to the latest version of the Linux kernel where this vulnerability has been patched.