Linux Kernel Zstandard Decompression Infinite Loop Vulnerability

A vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) Zstandard decompression logic can lead to an infinite loop. This issue occurs when the decompressed data is truncated in deliberately corrupted images, causing the decompression process to hang indefinitely. The vulnerability affects the Linux kernel stable tree.

Impact

Exploitation of this vulnerability can cause a denial of service by creating an infinite loop in the decompression process, which can lead to unresponsive system behavior.

Reproduction

The vulnerability can be reproduced by using a crafted image that contains deliberately corrupted Zstandard-compressed data. When this corrupted data is processed by the EROFS Zstandard decompression logic, the decompression will enter an infinite loop, failing to complete the operation.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been addressed.